AU2012296044A1

AU2012296044A1 - Information processing device, information processing method, program, and recording medium

Info

Publication number: AU2012296044A1
Application number: AU2012296044A
Authority: AU
Inventors: Koichi Sakumoto
Original assignee: Sony Corp
Current assignee: Sony Corp
Priority date: 2011-08-12
Filing date: 2012-06-25
Publication date: 2014-01-30
Anticipated expiration: 2032-06-25
Also published as: CA2839690A1; JP5790287B2; EP2744146A4; MX338025B; CN103718502B; US20140153717A1; JP2013042295A; TW201308969A; CN103718502A; MX2014001451A; EP2744146A1; BR112014002854A2; US9178700B2; RU2014104084A; KR20140046455A; TWI511517B; RU2603551C2; KR101986392B1; WO2013024629A1; AU2012296044B2

Abstract

[Problem] To implement an efficient, highly-secure public-key authentication scheme. [Solution] Provided is an information processing device that: generates a message on the basis of a tuple (F = (f

Description

SP336112WO00 1/121 Description Title of Invention INFORMATION PROCESSING APPARATUS, INFORMATION PROCESSING 5 METHOD, PROGRAM, AND RECORDING MEDIUM Technical Field [0001] The present technology relates to an information processing apparatus, an 10 information processing method, a program, and a recording medium. Background Art [0002] With the rapid development of information processing technologies and 15 communication technologies, documents have been digitized rapidly regardless of whether the documents are public or private. With the digitization of such documents, many individuals and companies have a considerable interest in security management of electronic documents. Countermeasures against tampering acts such as wiretapping or forgery of electronic documents have been actively studied in 20 various fields in response to an increase in this interest. Regarding the wiretapping of electronic documents, security is ensured, for example, by encrypting the electronic documents. Further, regarding the forgery of electronic documents, security is ensured, for example, by using digital signatures. However, when the encryption or the digital signature to be used does not have high tampering resistance, 25 sufficient security is not ensured. [0003] The digital signature is used for specifying the author of an electronic document. Accordingly, the digital signature should be able to be generated only by the author of the electronic document. If a malicious third party is able to generate 30 the same digital signature, such third party can impersonate the author of the electronic document. That is, an electronic document is forged by the malicious SP336112WO00 2/121 third party. Various opinions have been expressed regarding the security of the digital signature to prevent such forgery. As digital signature schemes that are currently widely used, a RSA signature scheme and a DSA signature scheme are known, for example. 5 [0004] The RSA signature scheme takes "difficulty of prime factorisation of a large composite number (hereinafter, prime factorisation problem)" as a basis for security. Also, the DSA signature scheme takes "difficulty of solving discrete logarithm problem" as a basis for security. These bases are based on that algorithms that 10 efficiently solve the prime factorisation problem and the discrete logarithm problem by using a classical computer do not exist. That is, the difficulties mentioned above suggest the computational difficulty of a classical computer. However, it is said that solutions to the prime factorisation problem and the discrete logarithm problem can be efficiently calculated when a quantum computer is used. 15 [0005] Similarly to the RSA signature scheme and the DSA signature scheme, many of the digital signature schemes and public-key authentication schemes that are currently used also take difficulty of the prime factorisation problem or the discrete logarithm problem as a basis for security. Thus, if the quantum computer is put to 20 practical use, security of such digital signature schemes and public-key authentication schemes will not be ensured. Accordingly, realizing new digital signature schemes and public-key authentication schemes is desired that take as a basis for security a problem different from problems such as the prime factorisation problem and the discrete logarithm problem that can be easily solved by the quantum 25 computer. As a problem which is not easily solved by the quantum computer, there is a problem related to a multivariate polynomial, for example. [0006] For example, as digital signature schemes that take the multivariate polynomial problem as a basis for security, those based on Matsumoto-Imai (MI) 30 cryptography, Hidden Field Equation (HFE) cryptography, Oil-Vinegar (OV) signature scheme, and Tamed Transformation Method (TTM) cryptography are SP336112WO00 3/121 known. For example, a digital signature scheme based on the HFE is disclosed in the following non-patent literatures 1 and 2. Citation List 5 Non-Patent Literature [0007] Non-Patent Literature 1: Jacques Patarin, Asymmetric Cryptography with a Hidden Monomial, CRYPTO 1996, pp. 45-60 Non-Patent Literature 2: Patarin, J., Courtois, N., and Goubin, L., QUARTZ, 10 128-Bit Long Digital Signatures, In Naccache, D., Ed. Topics in Cryptology - CT RSA 2001 (San Francisco, CA, USA, April 2001), vol. 2020 of Lecture Notes in Computer Science, Springer-Verlag., pp.282-297. Summary of Invention 15 Technical Problem [0008] As described above, the multivariate polynomial problem is an example of a problem called NP-hard problem which is difficult to solve even when using the quantum computer. Normally, a public-key authentication scheme that uses the 20 multivariate polynomial problem typified by the HFE or the like uses a multi-order multivariate simultaneous equation with a special trapdoor. For example, a multi order multivariate simultaneous equation F(x1,...,x 1 ) = y related to x 1 , ... , xI, and linear transformations A and B are provided, and the linear transformations A and B are secretly managed. In this case, the multi-order multivariate simultaneous 25 equation F and the linear transformations A and B are the trapdoors. [0009] An entity that knows the trapdoors F, A, and B can solve an equation B(F(A(x1,...,x))) y' related to x 1 , ... , x. On the other hand, the equation B(F(A(x1,...,x))) y' related to x 1 , ... , x 1 is not solved by an entity that does not 30 know the trapdoors F, A, and B. By using this mechanism, a public-key authentication scheme and a digital signature scheme that take the difficulty of SP336112WO00 4/121 solving a multi-order multivariate simultaneous equation as a basis for security can be realized. [0010] As mentioned above, in order to realize the public-key authentication 5 scheme or the digital signature scheme, it is necessary to prepare a special multi order multivariate simultaneous equation satisfying B(F(A(x1,...,xn))) = y. Further, at the time of the signature generation, it is necessary to solve the multi-order multivariate simultaneous equation F. For this reason, the available multi-order multivariate simultaneous equation F has been limited to relatively easily soluble 10 equations. That is, in the past schemes, only a multi-order multivariate simultaneous equation B(F(A(x1,...,xn))) = y of a combined form of three functions (trapdoors) B, F, and A that can be relatively easily solved has been used, and thus it is difficult to ensure sufficient security. [0011] 15 The present technology is devised in view of the above-mentioned circumstance and is intended to provide a novel and improved information processing apparatus, a novel and improved information processing method, a novel and improved program, and a novel and improved recording medium capable of realizing a public-key authentication scheme and a digital signature scheme that are 20 efficient and have high security using a multi-order multivariate simultaneous equation for which efficient solving means (trapdoor) is not known. Solution to Problem [0012] 25 According to an embodiment of the present technology, there is provided an information processing apparatus including a message generation unit that generates a message based on a pair of multi-order multivariate polynomials F = (fi, ..., fin) and a vector s that is an element of a set K", a message supply unit that supplies the message to a verifier storing the pair of multi-order multivariate polynomials F and 30 vectors y = (yi, ..., ym) = (fi(s), ..., fm(s)), an intermediate information generation unit that generates third information based on first information randomly selected by the SP336112WO00 5/121 verifier and second information obtained at a time of generation of the message, an intermediate information supply unit that supplies the third information to the verifier, and a response supply unit that supplies the verifier with response information corresponding to a verification pattern which the verifier selects from among k 5 (where k > 2) verification patterns. The vector s is a secret key. The pair of multi order multivariate polynomials F and the vectors y are public keys. The message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and the response information. The 10 pair of multi-order multivariate polynomials F include polynomials fi, ..., fm defined in a ring R of a characteristic q and an order q and are set in a manner that a polynomial G(xi, x2) defined as G(x1, x2) = F(x1 + x2) - F(x1) - F(x 2 ) with respect to vectors xi = (x 1 , ..., xi 1 ) (where 1 = 1, 2) is configured as a term proportional to (xl 1 )q(z) (where 1 i n, q(z) = qz, and 1 z k). 15 [0013] According to an embodiment of the present technology, there is provided an information processing apparatus including an information storage unit that stores a pair of multi-order multivariate polynomials F = (fi, ..., fn) and vectors y = (yi, ..., ym) = (fi(s), ..., fm(s)), a message acquisition unit that acquires a message generated 20 based on the pair of multi-order multivariate polynomials F and a vector s which is an element of a set K", an information supply unit that supplies randomly selected first information to a prover that supplies the message, an intermediate information acquisition unit that acquires third information generated by the prover based on the first information and second information obtained at a time of generation of the 25 message, a pattern information supply unit that supplies the prover with information on one verification pattern randomly selected from among k (where k > 3) verification patterns, a response acquisition unit that acquires response information corresponding to the selected verification pattern from the prover, and a verification unit that verifies whether or not the prover stores the vector s based on the message, 30 the first information, the third information, the pair of multi-order multivariate polynomials F, and the response information. The vector s is a secret key. The SP336112WO00 6/121 pair of multi-order multivariate polynomials F and the vectors y are public keys. The message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and the response information. 5 The pair of multi-order multivariate polynomials F include polynomials fi, ..., fm defined in a ring R of a characteristic q and an order q and are set in a manner that a polynomial G(x 1 , x 2 ) defined as G(x 1 , x 2 ) = F(x 1 + x 2 ) - F(x 1 ) - F(x 2 ) with respect to vectors xi = (xia, ..., xi 11 ) (where 1 = 1, 2) is configured as a term proportional to (xl 1 )q(,) (where 1 i n, q(z) = qz, and 1 z k). 10 [0014] According to an embodiment of the present technology, there is provided an information processing method including generating a message based on a pair of multi-order multivariate polynomials F = (fi, ..., fn) and a vector s that is an element of a set K", supplying the message to a verifier storing the pair of multi-order 15 multivariate polynomials F and vectors y = (yi, ..., ym) = (fi(s), ..., fm(s)), generating third information based on first information randomly selected by the verifier and second information obtained at a time of generation of the message, supplying the third information to the verifier, and supplying the verifier with response information corresponding to a verification pattern which the verifier selects from among k 20 (where k > 2) verification patterns. The vector s is a secret key. The pair of multi order multivariate polynomials F and the vectors y are public keys. The message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and the response information. The 25 pair of multi-order multivariate polynomials F include polynomials fi, ..., fm defined in a ring R of a characteristic q and an order q and are set in a manner that a polynomial G(x 1 , x2) defined as G(x 1 , x2) = F(x 1 + x2) - F(x 1 ) - F(x 2 ) with respect to vectors xi = (x 1 , ..., xi 1 1 ) (where 1 = 1, 2) is configured as a term proportional to (xl 1 )q(z) (where 1 i n, q(z) = qz, and 1 z k). 30 [0015] According to an embodiment of the present technology, there is provided an SP336112WO00 7/121 information processing method including, by an information processing apparatus storing a pair of multi-order multivariate polynomials F = (fi, ..., fn) and vectors y = (yi, ..., ym) = (fi(s), ..., fm(s)), acquiring a message generated based on the pair of multi-order multivariate polynomials F and a vector s which is an element of a set K", 5 supplying randomly selected first information to a prover that supplies the message, acquiring third information generated by the prover based on the first information and second information obtained at a time of generation of the message, supplying the prover with information on one verification pattern randomly selected from among k (where k > 3) verification patterns, and acquiring response information 10 corresponding to the selected verification pattern from the prover, verifying whether or not the prover stores the vector s based on the message, the first information, the third information, the pair of multi-order multivariate polynomials F, and the response information. The vector s is a secret key. The pair of multi-order multivariate polynomials F and the vectors y are public keys. The message is 15 information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and the response information. The pair of multi-order multivariate polynomials F include polynomials fi, ..., fm defined in a ring R of a characteristic q and an order q and are set in a manner that a 20 polynomial G(xi, x2) defined as G(x1, x2) = F(x1 + x2) - F(xi) - F(x 2 ) with respect to vectors xi = (xli, ..., xin) (where 1 = 1, 2) is configured as a term proportional to (xn 1 )q(z) (where 1 i n, q(z) = qz, and 1 z k). [0016] According to an embodiment of the present technology, there is provided a 25 program causing a computer to realize a message generation function of generating a message based on a pair of multi-order multivariate polynomials F = (fi, ..., fn) and a vector s that is an element of a set K", a message supply function of supplying the message to a verifier storing the pair of multi-order multivariate polynomials F and vectors y = (yi, ..., ym) = (fi(s), ..., fm(s)), an intermediate information generation 30 function of generating third information based on first information randomly selected by the verifier and second information obtained at a time of generation of the SP336112WO00 8/121 message, an intermediate information supply function of supplying the third information to the verifier, and a response supply function of supplying the verifier with response information corresponding to a verification pattern which the verifier selects from among k (where k > 2) verification patterns. The vector s is a secret 5 key. The pair of multi-order multivariate polynomials F and the vectors y are public keys. The message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and the response information. The pair of multi-order multivariate polynomials F include 10 polynomials fi, ..., fm defined in a ring R of a characteristic q and an order q and are set in a manner that a polynomial G(xi, X2) defined as G(x1, X2) = F(xi + X2) - F(xi) F(x 2 ) with respect to vectors xi (xiu, ..., xi 1 1 ) (where 1= 1, 2) is configured as a term proportional to (xn 1 )q(,) (where 1 i n, q(z) = qz, and 1 < z k). [0017] 15 According to an embodiment of the present technology, there is provided a program causing a computer to realize an information storage function of storing a pair of multi-order multivariate polynomials F = (fi, ..., fn) and vectors y = (yi, ..., ym) = (fi(s), ..., fm(s)), a message acquisition function of acquiring a message generated based on the pair of multi-order multivariate polynomials F and a vector s 20 which is an element of a set K", an information supply function of supplying randomly selected first information to a prover that supplies the message, an intermediate information acquisition function of acquiring third information generated by the prover based on the first information and second information obtained at a time of generation of the message, a pattern information supply 25 function of supplying the prover with information on one verification pattern randomly selected from among k (where k > 3) verification patterns, and a response acquisition unit of acquiring response information corresponding to the selected verification pattern from the prover, a verification function that verifies whether or not the prover stores the vector s based on the message, the first information, the 30 third information, the pair of multi-order multivariate polynomials F, and the response information. The vector s is a secret key. The pair of multi-order SP336112WO00 9/121 multivariate polynomials F and the vectors y are public keys. The message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and the response information. The 5 pair of multi-order multivariate polynomials F include polynomials fi, ..., fm defined in a ring R of a characteristic q and an order q and are set in a manner that a polynomial G(x1, x 2 ) defined as G(x1, x 2 ) = F(x1 + x 2 ) - F(x1) - F(x 2 ) with respect to vectors xi = (xli, ..., xin) (where 1 = 1, 2) is configured as a term proportional to (xl 1 )q(z) (where 1 i n, q(z) = qz, and 1 z k). 10 [0018] According to an embodiment of the present technology, there is provided a computer-readable recording medium having a program recorded thereon, the program causing a computer to realize a message generation function of generating a message based on a pair of multi-order multivariate polynomials F = (fi, ..., fn) and a 15 vector s that is an element of a set K", a message supply function of supplying the message to a verifier storing the pair of multi-order multivariate polynomials F and vectors y = (yi, ..., ym) = (fi(s), ..., fm(s)), an intermediate information generation function of generating third information based on first information randomly selected by the verifier and second information obtained at a time of generation of the 20 message, an intermediate information supply function of supplying the third information to the verifier, and a response supply function of supplying the verifier with response information corresponding to a verification pattern which the verifier selects from among k (where k > 2) verification patterns. The vector s is a secret key. The pair of multi-order multivariate polynomials F and the vectors y are public 25 keys. The message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and the response information. The pair of multi-order multivariate polynomials F include polynomials fi, ..., fm defined in a ring R of a characteristic q and an order q and are 30 set in a manner that a polynomial G(x 1 , x2) defined as G(x 1 , x2) = F(x 1 + x2) - F(x 1 ) F(x 2 ) with respect to vectors xi = (xli, ..., xln) (where 1 = 1, 2) is configured as a term SP336112WO00 10/121 proportional to (xn 1 )q(z) (where 1 i n, q(z) = qz, and 1 < z k). [0019] According to an embodiment of the present technology, there is provided a computer-readable recording medium having a program recorded thereon, the 5 program causing a computer to realize an information storage function of storing a pair of multi-order multivariate polynomials F = (fi, ..., fin) and vectors y = (yi, ..., ym) = (fi(s), ..., fm(s)), a message acquisition function of acquiring a message generated based on the pair of multi-order multivariate polynomials F and a vector s that is an element of a set K", an information supply function of supplying randomly 10 selected first information to a prover that supplies the message, an intermediate information acquisition function of acquiring third information generated by the prover based on the first information and second information obtained at a time of generation of the message, a pattern information supply function of supplying the prover with information on one verification pattern randomly selected from among k 15 (where k > 3) verification patterns, a response acquisition unit of acquiring response information corresponding to the selected verification pattern from the prover, and a verification function of verifying whether or not the prover stores the vector s based on the message, the first information, the third information, the pair of multi-order multivariate polynomials F, and the response information. The vector s is a secret 20 key. The pair of multi-order multivariate polynomials F and the vectors y are public keys. The message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and the response information. The pair of multi-order multivariate polynomials F include 25 polynomials fi, ..., fm defined in a ring R of a characteristic q and an order q and are set in a manner that a polynomial G(xi, x2) defined as G(x1, x2) = F(x1 + x2) - F(x1) F(x 2 ) with respect to vectors xi = (xli, ..., xln) (where 1 = 1, 2) is configured as a term proportional to (xn 1 )q(z) (where 1 i n, q(z) = qz, and 1 < z k). 30 Advantageous Effects of Invention [0020] SP336112WO00 11/121 According to the present technology described above, it is possible to realize a public-key authentication scheme and a digital signature scheme that are efficient and have high security using a multi-order multivariate simultaneous equation for which efficiently solving means (trapdoor) is not known. 5 Brief Description of Drawings [0021] [FIG. 1] FIG. 1 is an explanatory diagram for describing an algorithm structure related to a public-key authentication scheme. 10 [FIG. 2] FIG. 2 is an explanatory diagram for describing an algorithm structure related to a digital signature scheme. [FIG. 3] FIG. 3 is an explanatory diagram for describing an algorithm structure related to an n-pass public-key authentication scheme. [FIG. 4] FIG. 4 is an explanatory diagram for describing an example of a specific 15 algorithm structure related to a 3-pass public-key authentication scheme. [FIG. 5] FIG. 5 is an explanatory diagram for describing an efficient algorithm related to the 3-pass public-key authentication scheme. [FIG. 6] FIG. 6 is an explanatory diagram for describing parallelization of efficient algorithms related to the 3-pass public-key authentication scheme. 20 [FIG. 7] FIG. 7 is an explanatory diagram for describing an example of an algorithm of a public-key authentication scheme (scheme #1) using a 3-pass high-order multivariate polynomial. [FIG. 8] FIG. 8 is an explanatory diagram for describing an example of a parallelized algorithm of the public-key authentication scheme (scheme #1) using the 3-pass 25 high-order multivariate polynomial. [FIG. 9] FIG. 9 is an explanatory diagram for describing an example of a specific algorithm structure related to a 5-pass public-key authentication scheme. [FIG. 10] FIG. 10 is an explanatory diagram for describing an example of an efficient algorithm related to the 5-pass public-key authentication scheme. 30 [FIG. 11] FIG. 11 is an explanatory diagram for describing parallelization of the efficient algorithm related to the 5-pass public-key authentication scheme.

SP336112WO00 12/121 [FIG. 12] FIG. 12 is an explanatory diagram for describing an example of an algorithm of the public-key authentication scheme (scheme #1) using the 5-pass high-order multivariate polynomial. [FIG. 13] FIG. 13 is an explanatory diagram for describing an example of a 5 parallelized algorithm of the public-key authentication scheme (scheme #1) using the 5-pass high-order multivariate polynomial. [FIG. 14] FIG. 14 is an explanatory diagram for describing an example of an algorithm of the public-key authentication scheme (scheme #2) using the 5-pass high-order multivariate polynomial. 10 [FIG. 15] FIG. 15 is an explanatory diagram for describing an example of a parallelized algorithm of the public-key authentication scheme (scheme #2) using the 5-pass high-order multivariate polynomial. [FIG. 16] FIG. 16 is an explanatory diagram for describing an example of an efficient parallelized algorithm of the public-key authentication scheme (scheme #2) using the 15 5-pass high-order multivariate polynomial. [FIG. 17] FIG. 17 is an explanatory diagram for describing an example of a further efficient parallelized algorithm of the public-key authentication scheme (scheme #2) using the 5-pass high-order multivariate polynomial. [FIG. 18] FIG. 18 is an explanatory diagram for describing a method of modifying an 20 efficient algorithm related to the 3-pass public-key authentication scheme into an algorithm of a digital signature scheme. [FIG. 19] FIG. 19 is an explanatory diagram for describing a method of modifying a further efficient algorithm related to the 3-pass public-key authentication scheme into an algorithm of a digital signature scheme. 25 [FIG. 20] FIG. 20 is an explanatory diagram for describing a method of modifying an efficient algorithm related to the 5-pass public-key authentication scheme into an algorithm of the digital signature scheme. [FIG. 21] FIG. 21 is an explanatory diagram for describing a method of modifying a further efficient algorithm related to the 5-pass public-key authentication scheme into 30 an algorithm of the digital signature scheme. [FIG. 22] FIG. 22 is an explanatory diagram for describing a parallel serial structure SP336112WO00 13/121 of the efficient algorithm related to the 3-pass public-key authentication scheme. [FIG. 23] FIG. 23 is an explanatory diagram for describing a serial parallel structure of the efficient algorithm related to the 3-pass public-key authentication scheme. [FIG. 24] FIG. 24 is an explanatory diagram for describing a parallel serial structure 5 (parallel serial structure #1) of the efficient algorithm related to the 5-pass public-key authentication scheme. [FIG. 25] FIG. 25 is an explanatory diagram for describing a parallel serial structure (parallel serial structure #2) of the efficient algorithm related to the 5-pass public-key authentication scheme. 10 [FIG. 26] FIG. 26 is an explanatory diagram for describing a serial parallel structure (serial parallel structure #1) of the efficient algorithm related to the 5-pass public-key authentication scheme. [FIG. 27] FIG. 27 is an explanatory diagram for describing a serial parallel structure (serial parallel structure #2) of the efficient algorithm related to the 5-pass public-key 15 authentication scheme. [FIG. 28] FIG. 28 is an explanatory diagram for describing a hardware configuration example of an information processing apparatus capable of executing the algorithm according to each embodiment of the present technology. [FIG. 29] FIG. 29 is an explanatory diagram for describing a very suitable method of 20 setting a parameter used in the public-key authentication scheme according to the first and second embodiments of the present technology and the advantageous effects. Description of Embodiments [0022] 25 Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the appended drawings. Note that, in this specification and the drawings, elements that have substantially the same function and structure are denoted with the same reference signs, and repeated explanation is omitted. 30 [0023] [Flow of Description] SP336112WO00 14/121 Here, a flow of the description of embodiments of the present technology to be made below will be briefly described. First, an algorithm structure of a public key authentication scheme will be described with reference to FIG. 1. Next, an algorithm structure of a digital signature scheme will be described with reference to 5 FIG. 2. Next, an n-pass public-key authentication scheme will be described with reference to FIG. 3. [0024] Next, an example of an algorithm structure related to a 3-pass public-key authentication scheme will be described with reference to FIGS. 4 to 8. Next, an 10 example of an algorithm structure related to a 5-pass public-key authentication scheme will be described with reference to FIGS. 5 to 17. Next, a method of modifying the efficient algorithms related to the 3-pass and 5-pass public-key authentication schemes into algorithms of the digital signature scheme will be described with reference to FIGS. 18 to 21. 15 [0025] Next, a parallel serial structure and a serial parallel structure of the efficient algorithms related to the 3-pass and 5-pass public-key authentication schemes will be described with reference to FIGS. 22 to 27. Next, a hardware configuration example of an information processing apparatus capable of realizing each algorithm 20 according to the first and second embodiments of the present technology will be described with reference to FIG. 28. Finally, a summary of the technical spirit of the present embodiments and operational advantageous effects obtained from the technical spirit will be described in brief. [0026] 25 (Detailed Articles) 1. Introduction 1-1: Algorithm of Public-Key Authentication Scheme 1-2: Algorithms for Digital Signature Scheme 1-3: N-pass Public-key Authentication Scheme 30 2. Algorithm Structures Related to 3-pass Public-key Authentication Scheme 2-1: Example of Specific Algorithm Structure SP336112WO00 15/121 2-2: Efficient Algorithm Based on Quadratic Multivariate Polynomial 2-2-1: Basic Structure 2-2-2: Parallelized Algorithm 2-3: Efficient Algorithm Based on High-order Multivariate Polynomial 5 (Scheme #1) 2-3-1: Basic Structure 2-3-2: Parallelized Algorithm 3: Algorithm Structure Related to 5-pass Public-key Authentication Scheme 3-1: Example of Specific Algorithm Structure 10 3-2: Efficient Algorithm Based on Quadratic Multivariate Polynomial 3-2-1: Basic Structure 3-2-2: Parallelized Algorithm 3-3: Efficient Algorithm Based on High-order Multivariate Polynomial (First Embodiment) 15 3-3-1: Basic Structure 3-3-2: Parallelized Algorithm 3-4: Efficient Algorithm Based on High-order Multivariate Polynomial (Second Embodiment) 3-4-1: Basic Structure 20 3-4-2: Parallelized Algorithm (Structure Example 1) 3-4-3: Parallelized Algorithm (Structure Example 2: High Efficiency) 3-4-4: Parallelized Algorithm (Structure Example 2: Higher Efficiency) 4: Modification of Digital Signature Scheme 4-1: Modification of 3-pass Public-key Authentication Scheme into Digital 25 Signature Scheme 4-1-1: Digital Signature Algorithm (Structure Example 1) 4-1-2: Digital Signature Algorithm (Structure Example 2: High Efficiency) 4-2: Modification of 5-pass Public-key Authentication Scheme into Digital Signature Scheme 30 4-2-1: Digital Signature Algorithm (Structure Example 1) 4-2-2: Digital Signature Algorithm (Structure Example 2: High Efficiency) SP336112WO00 16/121 5: Hybrid Type Algorithm 5-1: Hybrid Type Algorithm Related to of 3-pass Public-key Authentication Scheme 5-1-1: Parallel Serial Algorithm 5 5-1-2: Serial Parallel Algorithm 5-2: Hybrid Type Algorithm Related to of 5-pass Public-key Authentication Scheme 5-2-1: Parallel Serial Algorithm (Structure Example #1) 5-2-2: Parallel Serial Algorithm (Structure Example #2) 10 5-2-3: Serial Parallel Algorithm (Structure Example #1) 5-2-4: Serial Parallel Algorithm (Structure Example #2) 6: Supplement 6-1: Method of Setting System Parameter 6-2: Method of Responding to Irregular Challenge 15 6-2-1: Responding Method by Prover 6-2-2: Responding Method by Verifier 7: Example of Hardware Configuration 8: Summary [0027] 20 <1. Introduction> The embodiments herein relate to a public-key authentication scheme and a digital signature scheme that base their safety on the difficulty of solving multi-order multivariate simultaneous equations. However, the embodiments herein differ from techniques of the related art such as HFE digital signature schemes, and relate to a 25 public-key authentication scheme and a digital signature scheme that utilize multi order multivariate simultaneous equations that lack a means of efficient solving (trapdoors). First, algorithms for a public-key authentication scheme, algorithms for a digital signature scheme, and an n-pass public-key authentication scheme will be briefly summarized. 30 [0028] [1-1: Algorithm of Public-Key Authentication Scheme] SP336112WO00 17/121 First, an overview of algorithm of a public-key authentication scheme will be described with reference to FIG. 1. FIG. 1 is an explanatory diagram for describing an algorithm structure of a public key authentication scheme. [0029] 5 A public key authentication is used when a person (prover) convinces another person (verifier) that she is the prover herself by using a public key pk and a secret key sk. For example, a public key pkA of a prover A is made known to the verifier B. On the other hand, a secret key skA of the prover A is secretly managed by the prover A. According to the public key authentication scheme, a person who 10 knows the secret key skA corresponding to the public key pkA is regarded as the prover A herself. [0030] In order for the prover A to prove to the verifier B that she is the prover A herself using the public-key authentication setup, the prover A, via a interactive 15 protocol, presents proof to the verifier B indicating that she knows the secret key skA corresponding to the public key pkA. The proof indicating the prover A knows the secret key skA is then presented to verifier B, and in the case where the verifier B is able to confirm that proof, the validity of the prover A (the fact that the prover A is herself) is proven. 20 [0031] However, a public-key authentication setup demands the following conditions in order to ensure safety. [0032] The first condition is "to lower as much as possible the probability of 25 falsification being established, at the time the interactive protocol is performed, by a falsifier not having the secret key sk". That this first condition is satisfied is called "soundness." In other words, the soundness means that "falsification is not established during the execution of an interactive protocol by a falsifier not having the secret key sk with a non-negligible probability". The second condition is that, 30 "even if the interactive protocol is performed, information on the secret key skA Of the prover A is not at all leaked to the verifier B". That this second condition is SP336112WO00 18/121 satisfied is called "zero knowledge." [0033] Conducting public-key authentication safely involves using an interactive protocol exhibiting both soundness and zero-knowledge. If an authentication 5 process were hypothetically conducted using an interactive protocol lacking soundness and zero-knowledge, there would be a definite chance of false verification and a definite chance of the divulgence of secret key information, and thus the validity of the prover would not be proven even if the process itself is completed successfully. Consequently, the question of how to ensure the soundness and zero 10 knowledge of a session protocol is important. [0034] (Model) In a model of the public key authentication scheme, two entities, namely a prover and a verifier, are present, as shown in FIG. 1. The prover generates a pair of 15 public key pk and secret key sk unique to the prover by using a key generation algorithm Gen. Then, the prover performs an interactive protocol with the verifier by using the pair of secret key sk and public key pk generated by using the key generation algorithm Gen. At this time, the prover performs the interactive protocol by using a prover algorithm P. As described above, in the interactive protocol, the 20 prover proves to the verifier, by using the prover algorithm P, that she possesses the secret key sk. [0035] On the other hand, the verifier performs the interactive protocol by using a verifier algorithm V, and verifies whether or not the prover possesses the secret key 25 corresponding to the public key that the prover has published. That is, the verifier is an entity that verifies whether or not a prover possesses a secret key corresponding to a public key. As described, a model of the public key authentication scheme is configured from two entities, namely the prover and the verifier, and three algorithms, namely the key generation algorithm Gen, the prover algorithm P and the verifier 30 algorithm V. [0036] SP336112WO00 19/121 Additionally, expressions "prover" and "verifier" are used in the following description, but these expressions strictly mean entities. Therefore, the subject that performs the key generation algorithm Gen and the prover algorithm P is an information processing apparatus corresponding to the entity "prover". Similarly, 5 the subject that performs the verifier algorithm V is an information processing apparatus. The hardware configuration of these information processing apparatuses is as shown in FIG. 28, for example. That is, the key generation algorithm Gen, the prover algorithm P, and the verifier algorithm V are performed by a CPU 902 based on a program recorded on a ROM 904, a RAM 906, a storage unit 920, a removable 10 recording medium 928, or the like. [0037] (Key Generation Algorithm Gen) The key generation algorithm Gen is used by a prover. The key generation algorithm Gen is an algorithm for generating a pair of public key pk and secret key 15 sk unique to the prover. The public key pk generated by the key generation algorithm Gen is published. Furthermore, the published public key pk is used by the verifier. On the other hand, the secret key sk generated by the key generation algorithm Gen is secretly managed by the prover. The secret key sk that is secretly managed by the prover is used to prove to the verifier of possession of the secret key 20 sk corresponding to the public key pk by the prover. Formally, the key generation algorithm Gen is represented as formula (1) below as an algorithm that takes security parameter 1k (X is an integer of 0 or more) as an input and outputs the secret key sk and the public key pk. [0038] 25 [Math 1] ( sk, Pkc),--G-n("I ) [0039] (Prover Algorithm P) The prover algorithm P is used by a prover. The prover algorithm P is an SP336112WO00 20/121 algorithm for proving to the verifier that the prover possesses the secret key sk corresponding to the public key pk. In other words, the prover algorithm P is an algorithm that takes the public key pk and the secret key sk as inputs and performs the interactive protocol. 5 [0040] (Verifier Algorithm V) The verifier algorithm V is used by the verifier. The verifier algorithm V is an algorithm that verifies whether or not the prover possesses the secret key sk corresponding to the public key pk during the session protocol. The verifier 10 algorithm V is an algorithm that accepts a public key pk as input, and outputs 0 or 1 (1 bit) according to the execution results of the session protocol. At this point, the verifier decides that the prover is invalid in the case where the verifier algorithm V outputs 0, and decides that the prover is valid in the case where the verifier algorithm V outputs 1. Formally, the verifier algorithm V is expressed as in the following 15 formula (2). [0041] [Math 2] 0/1 - V( pk) [0042] 20 As above, realizing meaningful public-key authentication involves having the interactive protocol satisfy the two conditions of soundness and zero-knowledge. However, proving that the prover possesses the secret key sk involves the prover executing a procedure dependent on the secret key sk, and after notifying the verifier of the result, causing the verifier to execute verification based on the content of the 25 notification. The procedure dependent on the secret key sk is executed to ensure soundness. At the same time, no information about the secret key sk should be revealed to the verifier. For this reason, the above key generation algorithm Gen, prover algorithm P, and verifier algorithm V are skillfully designed to satisfy these requirements.

SP336112WO00 21/121 [0043] The foregoing thus summarizes the algorithms in a public-key authentication scheme. [0044] 5 [1-2: Algorithms for Digital Signature Scheme] Next, algorithms for a digital signature scheme will be summarized with reference to FIG. 2. FIG. 2 is an explanatory diagram summarizing algorithms for a digital signature scheme. [0045] 10 Unlike paper documents, it is not possible to physically sign or affix a seal to digitized data. For this reason, proving the creator of digitized data involves an electronic setup yielding effects similarly to physically signing or affixing a seal to a paper document. This setup is digital signatures. A digital signature refers to a setup that associates given data with signature data known only to the creator of the 15 data, provides the signature data to a recipient, and verifies that signature data on the recipient's end. [0046] (Model) As illustrated in FIG. 2, the two identities of signer and verifier exist in a 20 model of a digital signature scheme. In addition, the model of a digital signature scheme is made up of three algorithms: a key generation algorithm Gen, a signature generation algorithm Sig, and a signature verifying algorithm Ver. [0047] The signer uses the key generation algorithm Gen to generate a paired 25 signature key sk and verification key pk unique to the signer. The signer also uses the signature generation algorithm Sig to generate a digital signature q to attach to a message M. In other words, the signer is an entity that attaches a digital signature to a message M. Meanwhile, the verifier uses the signature verifying algorithm Ver to verify the digital signature attached to the message M. In other words, the 30 verifier is an entity that verifies the digital signature q in order to confirm whether or not the creator of the message M is the signer.

SP336112WO00 22/121 [0048] Note that although the terms "signer" and "verifier" are used in the description hereinafter, these terms ultimately mean entities. Consequently, the agent that executes the key generation algorithm Gen and the signature generation 5 algorithm Sig is an information processing apparatus corresponding to the "signer" entity. Similarly, the agent that executes the signature verifying algorithm Ver is an information processing apparatus. The hardware configuration of these information processing apparatus is as illustrated in FIG. 28, for example. In other words, the key generation algorithm Gen, the signature generation algorithm Sig, and the 10 signature verifying algorithm Ver are executed by a device such as a CPU 902 on the basis of a program recorded onto a device such as ROM 904, RAM 906, a storage unit 920, or a removable recording medium 928. [0049] (Key Generation Algorithm Gen) 15 The key generation algorithm Gen is used by the signer. The key generation algorithm Gen is an algorithm that generates a paired signature key sk and verification key pk unique to the signer. The verification key pk generated by the key generation algorithm Gen is made public. Meanwhile, the signer keeps the signature key sk generated by the key generation algorithm Gen a secret. The 20 signature key sk is then used to generate digital signature q to attach to a message M. For example, the key generation algorithm Gen accepts a security parameter 1V (where p is an integer equal to or greater than 0) as input, and outputs a signature key sk and a verification key pk. In this case, the key generation algorithm Gen may be expressed formally as in the following formula (3). 25 [0050] [Math 3] (sk,pk) Gen( ) [0051] SP336112WO00 23/121 (Signature Generation Algorithm Sig) The signature generation algorithm Sig is used by the signer. The signature generation algorithm Sig is an algorithm that generates a digital signature q to be attached to a message M. The signature generation algorithm Sig is an 5 algorithm that accepts a signature key sk and a message M as input, and outputs a digital signature q. The signature generation algorithm Sig may be expressed formally as in the following formula (4). [0052] [Math 4] a Sig (k, A) 10 [0053] (Signature Verifying Algorithm Ver) The signature verifying algorithm Ver is used by the verifier. The signature verifying algorithm Ver is an algorithm that verifies whether or not the 15 digital signature q is a valid digital signature for the message M. The signature verifying algorithm Ver is an algorithm that accepts a signer's verification key pk, a message M, and a digital signature q as input, and outputs 0 or 1 (1 bit). The signature verifying algorithm Ver may be expressed formally as in the following formula (5). At this point, the verifier decides that the digital signature q is invalid 20 in the case where the signature verifying algorithm Ver outputs 0 (the case where the verification key pk rejects the message M and the digital signature q), and decides that the digital signature q is valid in the case where the signature verifying algorithm Ver outputs 1 (the case where the verification key pk accepts the message M and the digital signature q). 25 [0054] [Math 5] SP336112WO00 24/121 [0055] The foregoing thus summarizes the algorithms in a digital signature scheme. [0056] 5 [1-3: N-pass Public-key Authentication Scheme] Next, an n-pass public-key authentication scheme will be described with reference to FIG. 3. FIG. 3 is an explanatory diagram illustrating an n-pass public key authentication scheme. [0057] 10 As above, a public-key authentication scheme is an authentication scheme that proves to a verifier that a prover possesses a secret key sk corresponding to a public key pk during an interactive protocol. In addition, the interactive protocol has to satisfy the two conditions of soundness and zero-knowledge. For this reason, during the interactive protocol both the prover and the verifier exchange information 15 n times while executing respective processes, as illustrated in FIG. 3. [0058] In the case of an n-pass public-key authentication scheme, the prover executes a process using the prover algorithm P (operation #1), and transmits information T 1 to the verifier. Subsequently, the verifier executes a process using 20 the verifier algorithm V (operation #2), and transmits information T 2 to the prover. This execution and processes and transmission of information Tk is successively conducted for k = 3 to n (operation #k), and lastly, a process (operation #n+1) is executed. Transmitting and receiving information n times in this way is thus called an "n-pass" public-key authentication scheme. 25 [0059] The foregoing thus describes an n-pass public-key authentication scheme. [0060] <2. Algorithm Structures Related to 3-pass Public-key Authentication SP336112WO00 25/121 Scheme> Hereinafter, algorithms related to a 3-pass public-key authentication scheme will be described. Note that in the following description, a 3-pass public-key authentication scheme may also be referred to as a "3-pass scheme" in some cases. 5 [0061] [2-1: Example of Specific Algorithm Structure] First, an example of a specific algorithm structure related to the 3-pass scheme will be introduced with reference to FIG. 4. FIG. 4 is an explanatory diagram for describing a specific algorithm structure related to the 3-pass scheme. 10 An algorithm of the 3-pass scheme is made up of a key generation algorithm Gen, a prover algorithm P, and a verifier algorithm V Hereinafter, each algorithm structure will be described. [0062] (Key Generation Algorithm Gen) 15 The key generation algorithm Gen generates m multivariate polynomials fi(x 1 , ..., x.), ..., fm(xi, ..., x.) defined in a ring k and a vector s = (si, ..., s 1 ) that is an element of a set K". Next, the generation algorithm Gen calculates y = (yi, ..., ym) <- (fi(s), ..., fm(s)). Also, the generation algorithm Gen sets (fi(x 1 , ..., x), fm(xi, ..., x.), y) in the public key pk and sets s as a secret key. Hereinafter, a vector 20 (x1, ..., x,,) is represented as x and a pair of multivariate polynomials (f 1 (x), ..., fm(x)) is represented as F(x). [0063] (Prover Algorithm P, Verifier Algorithm V) Next, a process performed by the prover algorithm P and a process 25 performed by the verifier algorithm V during the interactive protocol will be described with reference to FIG. 4. [0064] During the foregoing interactive protocol, a prover does not leak information on the secret key s at all to a verifier and expresses to the verifier that 30 "she herself knows s satisfying y = F(s)." On the other hand, the verifier verifies whether or not the prover knows s satisfying y = F(s). The public key pk is SP336112WO00 26/121 assumed to be made known to the verifier. Also, the secret key s is assumed to be secretly managed by the prover. Hereinafter, the description will be made with reference to the flowchart illustrated in FIG. 4. [0065] 5 Operation #1: First, the prover algorithm P selects any number of seed. Subsequently, the prover algorithm P generates a vector ro which is an element of the set K" and a number seed 1 by applying the number seed to a pseudo-random number generator PRNG. That is, the prover algorithm P calculates (ro, seed) <- PRNG(seedo). 10 Subsequently, the prover algorithm P generates a multivariate polynomial F 1 (x) = (fli(x), ..., fim(x)) by applying the number seed to the pseudo-random number generator PRNG. That is, the prover algorithm P calculates F 1 <- PRNG seeddi. [0066] Operation #1 (continued): 15 Subsequently, the prover algorithm P calculates ri <- s -ro. This calculation is equivalent to masking the secret key s with the vector ro. Additionally, the prover algorithm P calculates F 2 (x) <- F(x + ro) + F1(x). This calculation is equivalent to masking the multivariate polynomial F(x+ro) for x with the multivariate polynomial

F

1 (x). 20 [0067] Operation #1 (continued): Subsequently, the prover algorithm P generates a hash value co of ri and F1(ri). That is, the prover algorithm P calculates co <- H(F1(ri), ri). Also, the prover algorithm P generates a hash value ci of the number seed 1 . That is, the 25 prover algorithm P calculates ci <- H(seedi). Also, the prover algorithm P generates a hash value c2 of a multivariate polynomial F 2 . That is, the prover algorithm P calculates c2 <- H(F 2 ). The hash values (co, c 1 , c2) are sent as a message to the verifier algorithm V. At this time, it should be noted that information on s, information on ro, and information on ri are not at all leaked to the verifier. 30 [0068] Operation #2: SP336112WO00 27/121 Upon receiving the message (co, c 1 , c 2 ), the verifier algorithm V selects which verification pattern to use from among three verification patterns. For example, the verifier algorithm V may select a numerical value from among three numerical values {0, 1, 21 representing verification patterns, and set the selected 5 numerical value in a challenge Ch. This challenge Ch is sent to the prover algorithm P. [0069] Operation #3: Upon receiving the challenge Ch, the prover algorithm P generates a 10 response Rsp to send to the verifier algorithm V in response to the received challenge Ch. In the case where Ch = 0, the prover algorithm P generates a response Rsp = seed. In the case where Ch = 1, the prover algorithm P generates a response Rsp = seedd, ri). In the case where Ch = 2, the prover algorithm P generates a response Rsp = (F 2 , ri). The response Rsp generated in operation #3 is sent to the verifier 15 algorithm V. At this time, it should be noted that the information on ri is not at all leaked to the verifier in the case where Ch 0, and the information on ro is not at all leaked to the verifier in the case where Ch 1 or 2. [0070] Operation #4: 20 Upon receiving the response Rsp, the verifier algorithm V executes the following verification process using the received response Rsp. [0071] In the case where Ch = 0, the verifier algorithm V calculates (ro, seed) < PRNG(Rsp). Also, the verifier algorithm V calculates F 1 <- PRNG(seedi). Then, 25 the verifier algorithm V verifies whether or not the equality of ci = H(seedi) holds. In addition, the verifier algorithm V verifies whether or not the equality of c2= H(F(x + ro) + F1(x)) holds. The verifier algorithm V outputs the value 1 to indicate authentication success in the case where these verifications all succeed, and outputs the value 0 to indicate authentication failure in the case where a verification fails. 30 [0072] In the case where Ch = 1, the verifier algorithm V sets seedd, ri) <- Rsp.

SP336112WO00 28/121 Also, the verifier algorithm V calculates F 1 <- PRNG(seedi). Then, the verifier algorithm V verifies whether or not the equality of co = H(F1(ri), ri) holds. In addition, the verifier algorithm V verifies whether or not the equality of ci = H(seedi) holds. The verifier algorithm V outputs the value 1 to indicate authentication 5 success in the case where these verifications all succeed, and outputs the value 0 to indicate authentication failure in the case where a verification fails. [0073] In the case where Ch = 2, the verifier algorithm V sets (F 2 , ri) <- Rsp. Then, the verifier algorithm V verifies whether or not the equality of co = H(F 2 (ri) - y, 10 ri) holds. In addition, the verifier algorithm V verifies whether or not the equality of c2 = H(F 2 ) holds. The verifier algorithm V outputs the value 1 to indicate authentication success in the case where these verifications all succeed, and outputs the value 0 to indicate authentication failure in the case where a verification fails. [0074] 15 (Soundness) Here, the description of the soundness of the algorithms related to the 3-pass scheme will be supplemented. The soundness of the algorithms related to the 3 pass scheme is ensured based on the logic that F 2 , F 1 , ro, and ri satisfying the following formula (6) and formula (7) below can be calculated when the prover 20 algorithm P returns an appropriate response Rsp for all of the challenges Ch = 0, 1, and 2 selectable by the verifier algorithm V." [0075] [Math 6] 2 (x)= F(x+r)+F(x) (6 ) F(rj)-y= F(r) (7) 25 [0076] SP336112WO00 29/121 By ensuring the foregoing soundness, the fact that successful forgery with a probability higher than 2/3 is not possible is ensured as long as the problem of solving the multi-order multivariate simultaneous equations is not solved. That is, to appropriately make the response to all of the challenges Ch = 0, 1, 2 of the verifier, 5 the falsifier has to calculate F 2 , F 1 , ro, and ri satisfying the foregoing formula (6) and formula (7). In other words, the falsifier has to calculate s satisfying F(s) = y. However, there remains a probability of the falsifier making appropriate responses for two higher challenges among the challenges Ch = 0, 1, 2 of the verifier. Therefore, the success probability of the false verification becomes 2/3. Further, by 10 repeatedly executing the foregoing interactive protocol a sufficiently large number of times, the probability of a successful forgery becomes negligibly small. [0077] (Hash Function H) Here, the description of a hash function H will be supplemented. In the 15 foregoing algorithms, cO, c 1 , c2, and the like are calculates using the hash function H. However, a commitment function COM may be used instead of the hash function H. The commitment function COM is a function in which a character string S and a random number p are factors. An example of the commitment function includes a scheme published in the international conference CRYPTO 1996 by Shai Halevi and 20 Silvio Micali. [0078] For example, a case in which co, ci, and c 2 are calculated using the commitment function COM will be considered. In this case, random numbers po, pi, and P2 are prepared before co, ci, and c 2 are calculated, and co, ci, and c 2 are 25 generated by applying commitment functions COM(-,po), COM(-,pi) ,and COM(-,p 2 ), instead of applying the hash function H(-). Further, pi necessary for the verifier to generate ci is set to be included in the response Rsp and be sent. [0079] The example of the specific algorithm structure related to the 3-pass scheme 30 has been introduced above. [0080] SP336112WO00 30/121 [2-2: Efficient Algorithm Based on Quadratic Multivariate Polynomial] Next, a method of making the algorithms related to the 3-pass scheme efficient will be described. Here, a case in which a pair of quadratic polynomials (fi(x), ..., fm(x)) are used as multivariate polynomials F will be described. Here, a 5 quadratic polynomial fi(x) is assumed to be expressed as in the following formula (8). [0081] [Math 7] fi(1 '" n)z:Za ijkxjXk + b~jx j,kj (8) [0082] 10 Also, the pair of quadratic polynomials (fi(x), ..., fm(x)) can be expressed as in the following formula (9). Here, x = (x 1 , ..., x'). A 1 , ..., Am is a n x n matrix. Further, each of bi, ..., bm is an n x 1 vector. [0083] [Math 8] f(x x Ax+b x F(x)= f~(M x 1,, x 15~~ ( [0084] When this expression is used, a multivariate polynomial F can be expressed as in the following formula (10) and formula (11). From the following formula (12), it can easily be confirmed that this expression is satisfied. 20 [0085] SP336112WO00 31/121 [Math 9] F(x + y)= F(x) + F(y) + G(x,y) y T( A" +4 A)X G(x, y) yT( A T+ A4, )x J(x+ y)=(x+ y)' A,(x+y)+b,(x+ y) xrAix + x'Ay + yAx + y'Ay + b/x ±b/y f (x)+ f (v) + xr'A,y + yTA~x f(X)+ f(y)+ f +x )( ' y+y jAx =j;(x)+ f (y)+ (Afx)' y + y Ax f x) + f,(Y) + (A x) +y x = f(x)+ fj(y)+7y( A +A 1 )x [0086] When dividing F(x + y) into a first portion dependent on x, a second portion 5 dependent on y, and a third portion dependent on both x and y in this way, the term G(x, y) corresponding to the third portion becomes bilinear with respect to x and y. Using this property enables the construction of an efficient algorithm. [0087] For example, use the vector to that is an element of the set K" and the vector 10 eo that is an element of the set K' to express the multivariate polynomial F1(x), which is used to mask the multivariate polynomial F(x + r), as F1(x) = G(x, to) + eo. In this case, the sum of the multivariate polynomial F(x + ro) and G(x) is expressed SP336112WO00 32/121 as in formula (13) below. [0088] Here, when ti = ro + to, ei = F(ro) + eo, the multivariate polynomial F 2 (x) F(x + ro) + F1(x) can be expressed by the vector ti which is an element of the set K" 5 and the vector ei that is an element of the set K'. For this reason, when "F1(x) = G(x, to) + eo" is set, F 1 and F 2 can be expressed by using a vector in K" and a vector in K', and thus a data size necessary for communication can be considerably reduced. Specifically, communication efficiency can be improved to the degree of thousands to tens of thousands of times. 10 [0089] [Math 10] F(x+ r.) + (x) F(x) + F(r) + G(x, r 0 ) + G(x, to) +e =.F(x)+G(x,r, +t )+ F(r,)+e [0090] Through the foregoing modification, information on ro is not at all leaked 15 from F 2 (or F 1 ). For example, even when ei and ti (or eo and to) are given, the information on ro is not known at all as long as eo and to (or ei and ti) are not known. Accordingly, the zero knowledge is ensured. Hereinafter, an efficient algorithm related to the 3-pass scheme will be described with reference to FIGS. 5 and 6. [0091] 20 (2-2-1: Basic Structure (FIG. 5)) First, a basic structure of an efficient algorithm related to the 3-pass scheme will be described with reference to FIG. 5. However, further description of the structure of the key generation algorithm Gen will be omitted. [0092] 25 Operation #1: As illustrated in FIG. 5, the prover algorithm P first randomly generates the SP336112WO00 33/121 vector ro, to that is an element of the set K", and the vector eo that is an element of the set K'. Subsequently, the prover algorithm P calculates ri <- s - ro. This calculation is equivalent to masking the secret key s with the vector ro. Additionally, the prover algorithm P calculates ti <- ro - to. Subsequently, the prover algorithm P 5 calculates ei <- F(ro) - eo. [0093] Operation #1 (continued): Subsequently, the prover algorithm P calculates co <- H(ri, G(to, ri) + eo). Subsequently, the prover algorithm P calculates ci <- H(to, eo). Subsequently, the 10 prover algorithm P calculates c 2 <- H(ti, ei). The message (co, c 1 , c 2 ) generated in operation #1 is sent to the verifier algorithm V. [0094] Operation #2: Upon receiving the message (co, c 1 , c2), the verifier algorithm V selects 15 which verification pattern to use from among three verification patterns. For example, the verifier algorithm V may select a numerical value from among three numerical values {0, 1, 21 representing verification patterns, and set the selected numerical value in a challenge Ch. This challenge Ch is sent to the prover algorithm P. 20 [0095] Operation #3: Upon receiving the challenge Ch, the prover algorithm P generates a response Rsp to send to the verifier algorithm V in response to the received challenge Ch. In the case where Ch = 0, the prover algorithm P generates a response Rsp = (ro, 25 ti, ei). In the case where Ch = 1, the prover algorithm P generates a response Rsp = (ri, to, eo). In the case where Ch = 2, the prover algorithm P generates a response Rsp = (ri, ti, ei). The response Rsp generated in operation #3 is sent to the verifier algorithm V. [0096] 30 Operation #4: Upon receiving the response Rsp, the verifier algorithm V executes the SP336112WO00 34/121 following verification process using the received response Rsp. [0097] In the case where Ch = 0, the verifier algorithm V verifies whether or not the equality of c 1 = H(ro - ti, F(ro) - ei) holds. In addition, the verifier algorithm V 5 verifies whether or not the equality of c2= H(ti, ei) holds. The verifier algorithm V outputs the value 1 to indicate authentication success in the case where these verifications all succeed, and outputs the value 0 to indicate authentication failure in the case where a verification fails. [0098] 10 In the case where Ch = 1, the verifier algorithm V verifies whether or not the equality of co= H(ri, G(to, ri) + eo) holds. In addition, the verifier algorithm V verifies whether or not the equality of ci = H(to, eo) holds. The verifier algorithm V outputs the value 1 to indicate authentication success in the case where these verifications all succeed, and outputs the value 0 to indicate authentication failure in 15 the case where a verification fails. [0099] In the case where Ch = 2, the verifier algorithm V verifies whether or not the equality of co= H(ri, y - F(ri) - G(ti, ri) - ei) holds. In addition, the verifier algorithm V verifies whether or not the equality of c 2 = H(ti, ei) holds. The verifier 20 algorithm V outputs the value 1 to indicate authentication success in the case where these verifications all succeed, and outputs the value 0 to indicate authentication failure in the case where a verification fails. [0100] The example of the efficient algorithm structure related to the 3-pass 25 scheme has been described above. By using the algorithms, the data size necessary for communication is considerably reduced. [0101] (2-2-2: Parallelized Algorithm (FIG. 6)) Next, a method of parallelizing the algorithms illustrated in FIG. 5 will be 30 described with reference to FIG. 6. However, further description of the structure of the key generation algorithm Gen will be omitted.

SP336112WO00 35/121 [0102] As described above, applying the above session protocol makes it possible to keep the probability of a successful forgery to 2 / 3 or less. Consequently, executing the session protocol twice makes it possible to keep the probability of a 5 successful forgery to (2 / 3)2 or less. Furthermore, if the session protocol is executed N times, the probability of a successful forgery becomes (2 / 3)N, and if N is set to a sufficiently large number (N = 140, for example), the probability of a successful forgery becomes negligibly small. [0103] 10 Conceivable methods of executing an interactive protocol multiple times include a serial method that sequentially repeats the exchange of message, challenge, and response multiple times, and a parallel method that exchanges multiple messages, challenges, and responses in a single exchange, for example. Here, algorithms that execute the above interactive protocol related to a 3-pass scheme in parallel 15 (hereinafter designated parallelized algorithms) will now be described. [0104] Operation #1: The prover algorithm P first executes the following processes (1) to (6) for i 1 to N. 20 Process (1): The prover algorithm P randomly generates the vectors roi, toi that are elements of the set K", and the vector e 0 i that is an element of the set K'. Process (2): The prover algorithm P calculates rii <- s - roi. This calculation is equivalent to masking the secret key s with the vector r 0 . Additionally, the prover 25 algorithm P calculates t 1 i <- roi + toi. Process (3): The prover algorithm P calculates e 1 i <- F(roi) - eoi. Process (4): The prover algorithm P calculates coi <- H(rii, G(rii, toi) + eoi). Process (5): The prover algorithm P calculates cii <- H(toi, eoi). Process (6): The prover algorithm P calculates c2i <- H(t 1 , e 1 i). 30 [0105] Operation #1 (continued): SP336112WO00 36/121 After executing the above processes (1) to (6) for i = 1 to N, the prover algorithm P calculates Cmt <- H(coi, C 11 , c2 1 , ... , coN, ClN, C2N). The hash value Cmt generated in operation #1 is sent to the verifier algorithm V. In this way, the message (coi, C 11 , c 2 1 , ... , coN, ClN, C2N) is converted into a hash value before being 5 sent to the verifier algorithm V, thus enabling a reduction in the communication volume. [0106] Operation #2: Upon receiving the hash value Cmt, the verifier algorithm V selects which 10 verification pattern to use from among three verification patterns, for each of i = 1 to N. For example, the verifier algorithm V may, for each of i = 1 to N, select a numerical value from among three numerical values {0, 1, 21 representing verification patterns, and set the selected numerical value in a challenge Chi. The challenges Chi, ..., ChN are sent to the prover algorithm P. 15 [0107] Operation #3: Upon receiving the challenges Chi, ..., ChN, the prover algorithm P generates responses Rspi, ..., RspN to send to the verifier algorithm V in response to each of the received challenges Chi, ..., ChN. In the case where Chi = 0, the prover 20 algorithm P generates a response Rspi = (roi, tij, e 1 , coi). In the case where Chi = 1, the prover algorithm P generates a response Rspi = (rii, toi, eoi, c2i). In the case where Chi= 2, the prover algorithm P generates a response Rspi= (rii, t 1 , e 1 , c 1 ). [0108] The responses Rspi, ..., RspN generated in operation #3 are sent to the 25 verifier algorithm V. [0109] Operation #4: Upon receiving the responses Rspi, ..., RspN, the verifier algorithm V executes the following processes (1) to (3) for i = 1 to N, using the received 30 responses Rspi, ..., RspN. Herein, the verifier algorithm V executes the process (1) for the case where Chi = 0, the process (2) in the case where Chi = 1, and the process SP336112WO00 37/121 (3) in the case where Chi = 2. [0110] Process (1): In the case where Chi = 0, the verifier algorithm V retrieves (roi, t 1 , e 1 , coi) from Rspi. Subsequently, the verifier algorithm V calculates cii= H(roi 5 tij, F(roi) - e 1 ). In addition, the verifier algorithm V calculates c2i = H(tii, e 1 i). The verifier algorithm V then stores (coi, cii, c2i). [0111] Process (2): In the case where Chi = 1, the verifier algorithm V retrieves (r 1 , toi, eoi, c2i) from Rspi. Subsequently, the verifier algorithm V calculates c 0 i = H(rii, 10 G(rii, toi) + eoi). In addition, the verifier algorithm V calculates cii = H(toi, eoi). The verifier algorithm V then stores (coi, cii, c2i). [0112] Process (3): In the case where Chi = 2, the verifier algorithm V retrieves (r 1 , tij, e 1 , cii) from Rspi. Subsequently, the verifier algorithm V calculates coi = H(rii, y 15 - F(rii) - G(tii, r 1 ) - e 1 ). In addition, the verifier algorithm V calculates c2i = H(tii, e 1 ). The verifier algorithm V then stores (coi, cii, c 2 i). [0113] After executing the above processes (1) to (3) for i = 1 to N, the verifier algorithm V verifies whether or not the equality of Cmt = H(coi, C 11 , c 2 1 , ... , coN, ClN, 20 c2N) holds. The verifier algorithm V outputs the value 1 to indicate authentication success in the case where the verification succeeds, and outputs the value 0 to indicate authentication failure in the case where the verification fails. [0114] The example of the structures of the parallelized efficient algorithms related 25 to the 3-pass scheme has been described above. Also, the parallelized algorithms shown in FIG. 6 include the contrivance in which the message is converted into the hash value before being sent. The contrivance improves communication efficiency. Similarly, the structure may be modified such that the challenges Chi, ..., ChN or the responses Rspi, ..., RspN are converted into hash values before being sent. 30 Modifying the structure in this way enables a further improvement in the communication efficiency to be expected.

SP336112WO00 38/121 [0115] [2-3: Efficient Algorithm Based on High-order Multivariate Polynomial (Scheme #1)] The foregoing efficient algorithms use the property in that the polynomial G 5 defined in the foregoing formula (10) becomes bilinear by expressing the multivariate polynomial F with the pair of quadratic polynomials fi defined in the foregoing formula (8). However, when the polynomial G is additively homomorphic, an efficient algorithm can be constructed likewise even when the polynomial G is not bilinear. 10 [0116] (Construction of Efficient Algorithm Using Quadratic Polynomial fi) When the polynomial G is additively homomorphic, a relation of the following formula (14) to formula (16) is established using variables ro, ri, to, and eo. Also, the following formula (14) is a formula obtained by dividing the secret key s 15 into s = ro + ri and developing the public key F(s). The following formula (14) to formula (16) can be divided into a first portion (ri, to, eo) reproducible with (ro, ti, el), a second portion (ri, ti, ei) reproducible with (ri, to, eo), and a third portion reproducible with (ri, ti, ei). [0117] 20 For example, "ro, ti" included in the following formula (15) and "F(ro), ei" included in the following formula (16) are the first portion. Additionally, "eo, G(to, ri)" included in the following formula (14), "to" included in the following formula (15), and "eo" included in the following formula (16) are the second portion. Additionally, "ei, F(ri), G(ti, ri)" included in the following formula (14) is the third 25 portion. In other words, the following formula (14) includes the second and third portions, the following formula (15) includes the first and second portions, and the following formula (16) includes the first and second portions. [0118] As described above, the following formula (14) to formula (16) each include 30 two kinds of portions. Additionally, from the definition of the secret key s and the relation among the following formula (14) to formula (16), it is ensured that the SP336112WO00 39/121 secret key s is not obtainable even when any one of (ro, ti, ei), (ri, to, eo), and (ri, ti, ei) is used. Using this property enables, for example, the construction of an efficient algorithm related to the 3-pass scheme shown in FIG. 5. [0119] 5 [Math 11] + 1 r +e r. F r ) G(tr) + G(tjrj) (1 4) ro = to + t, F(ro) eo+ 4 e± [0120] (Construction of Efficient Algorithm Using Cubic Polynomial fi) A method of constructing an efficient algorithm using a cubic polynomial fi 10 of a ring R expressed as in the following formula (17) will be examined by developing the foregoing description of the case where the quadratic polynomial fi. A multivariate polynomial F = (fi, ..., fm) expressed with a pair of cubic polynomials fi satisfies the relation of the following formula (18). Here, Gx(x, y) represents a linear term for x. Additionally, Gy(x, y) represents a linear term for y. When Gx = 15 (gxi, ..., gxm) and Gy = (gyi, ..., gym) are expressed, gxi and gyi can be developed as in the following formula (19) and formula (20), respectively. Here, since the right second term of gxi is also linear for one of x and y, the right second term may include gyi. [0121] 20 [Math 12] SP336112WO00 40/121 x-,x = Xaxxx,+j b,,,xx 1 + Zcx i~jsk i~ F(x+y)- F(x)- F(y)= G,(x,y) + G,(xy) = (a,4 + a +y y + +b Q|Jk [0122] As understood from the foregoing formula (19) and formula (20), Gx(x, y) and Gy(x, y) become additively homomorphic for x and y. Thus, using this property, 5 the public key F(s) is divided by introducing the new variables ro, ri, to, uo, and eo, as in the method of constructing the efficient algorithm using the quadratic polynomial fi. [0123] Since the polynomials Gx and Gy are additively homomorphic, a relation 10 among the following formula (21) to formula (24) is established using variables ro, ri, to, uo, and eo. The following formula (21) to formula (24) can be divided into a first portion reproducible with (ro, to, uo, eo), a second portion reproducible with (ro, ui, ei), a third portion reproducible with (ri, to, eo), and a fourth portion reproducible with (ri, ti, ui, ei). 15 [0124] SP336112WO00 41/121 For example, "ro, to" included in the following formula (22), "uo" included in the following formula (23), and "F(ro), Gy(ro, uo), eo" included in the following formula (24) are the first portion. Additionally, "Gy(ro, ui), ei" included in the following formula (24) is the second portion. Additionally, "eo, Gx(ro, ri)" included 5 in the following formula (21) is the third portion. Additionally, "ei, F(ri), Gx(ti, ri)" included in the following formula (21), "t 1 " included in the following formula (22), and "ui" included in the following formula (23) are the fourth portion. [0125] In other words, the following formula (21) includes the third and fourth 10 portions, the following formula (22) and the following formula (23) include the first and fourth portions, and the following formula (24) includes the first and second portions. In this way, the following formula (21) to formula (24) each include two kinds of portions. [0126] 15 From the definition of the secret key s and the relation among the following formula (21) to formula (24), it is ensured that the secret key s is not obtainable even when any one of (ro, to, uo, eo), (ro, ui, ei), (ri, to, eo), and (ri, ti, ui, ei) is used. Using this property enables, for example, the construction of an efficient algorithm (hereinafter, an extended algorithm) related to the 3-pass scheme using the cubic 20 polynomial fi of the ring R. [0127] [Math 13] SP336112WO00 42/121 F(r + i) = +e,+ F(r)+ G&,( ) +G,(ti) (21) r =to+ t, 1-(2 3) F(r) + G ,r.,u )+ G,(r,u) e) e - (24) [0128] Hereinafter, an example of a specific extended algorithm structure will be described. Two basic points regarding design of an extended algorithm are that a 5 message expressed in the following formula (25) to formula (27) is sent to a verifier and that one of the first to fourth portions is verified. However, only in this verification, it may not be verified that "ri" included in the third portion is identical with "ri" included in the fourth portion. Similarly, it may not be verified that "ro" included in the first portion is identical with "ro" included in the second portion and 10 that "to, eo" included in the first portion is identical with "to, eo" included in the third portion, either. Additionally, it may not be verified that "ui, ei" included in the second portion is identical with "ui, ei" included in the fourth portion, either. Accordingly, a structure example enabling this verification will be introduced below. [0129] 15 [Math 14] SP336112WO00 43/121 c0 =H(G (t 0 r )+e 0 ) (2 5 c1 = H10",) (2 6) c2 =zH G (r, )) (2 7) [0130] (2-3-1: Basic Structure (FIG. 7)) First, a basic structure of an extended algorithm related to the 3-pass scheme 5 will be described with reference to FIG. 7. However, further description of the structure of the key generation algorithm Gen will be omitted. [0131] Operation #1: As illustrated in FIG. 7, the prover algorithm P randomly generates the 10 vectors ro, to, uo that are elements of the set K", and the vector eo that is an element of the set K'. Subsequently, the prover algorithm P calculates ri <- s - ro. This calculation is equivalent to masking the secret key s with the vector ro. Subsequently, the prover algorithm P calculates ti <- ro + to. Subsequently, the prover algorithm P calculates ui <- ri + uo. Subsequently, the prover algorithm P 15 calculates ei <- F(ro) - eo. [0132] Operation #1 (continued): Subsequently, the prover algorithm P calculates co <- H(ri, Gx(to, ri) + eo). Subsequently, the prover algorithm P calculates ci <- H(ro - to, uo). Subsequently, 20 the prover algorithm P calculates c 2 <- H(ro, ei - Gy(ro, ui)). Subsequently, the prover algorithm P calculates c3 <- H(to, eo). Subsequently, the prover algorithm P calculates c4 <- H(ui, ei). Messages (co, c 1 , c2, c3, c4) generated in operation #1 are sent to the verifier algorithm V.

SP336112WO00 44/121 [0133] Operation #2: Upon receiving the messages (co, ci, C2, C3, C4), the verifier algorithm V selects which verification pattern to use from among four verification patterns. For 5 example, the verifier algorithm V may select a numerical value from among four numerical values {0, 1, 2, 31 representing verification patterns, and set the selected numerical value in a challenge Ch. The challenge Ch is sent to the prover algorithm P. [0134] 10 Operation #3: Upon receiving the challenge Ch, the prover algorithm P generates responses Rsp to send to the verifier algorithm V in response to each of the received challenge Ch. In the case where Ch = 0, the prover algorithm P generates a response Rsp = (ro, to, uo, eo). In the case where Ch = 1, the prover algorithm P 15 generates a response Rsp = (ro, ui, ei). In the case where Ch = 2, the prover algorithm P generates a response Rsp = (ri, to, eo). In the case where Ch = 3, the prover algorithm P generates a response Rsp = (ri, ti, ui, ei). The response Rsp generated in operation #3 is sent to the verifier algorithm V. [0135] 20 Operation #4: Upon receiving the response Rsp, the verifier algorithm V executes the following verification process using the received response Rsp. [0136] In the case where Ch = 0, the verifier algorithm V verifies whether or not 25 the equality of ci = H(ro - to, uo) holds. Subsequently, the verifier algorithm V verifies whether or not the equality of c2 = H(ro , F(ro) + Gy(ro, uo) - eo) holds. Subsequently, the verifier algorithm V verifies whether or not the equality of c3 = H(to, eo) holds. The verifier algorithm V outputs the value 1 to indicate authentication success in the case where the verifications all succeed, and outputs the 30 value 0 to indicate authentication failure in the case where a verification fails. [0137] SP336112WO00 45/121 In the case where Ch = 1, the verifier algorithm V verifies whether or not the equality of C2 = H(ro, ei - Gy(ro, ui)) holds. Subsequently, the verifier algorithm V verifies whether or not the equality of C4 = H(ui, ei) holds. The verifier algorithm V outputs the value 1 to indicate authentication success in the case where the 5 verifications all succeed, and outputs the value 0 to indicate authentication failure in the case where a verification fails. [0138] In the case where Ch = 2, the verifier algorithm V verifies whether or not the equality of co = H(ri, eo - Gx(to, ri)) holds. Subsequently, the verifier algorithm 10 V verifies whether or not the equality of c 3 = H(to, eo) holds. The verifier algorithm V outputs the value 1 to indicate authentication success in the case where the verifications all succeed, and outputs the value 0 to indicate authentication failure in the case where a verification fails. [0139] 15 In the case where Ch = 3, the verifier algorithm V verifies whether or not the equality of co = H(ri, y - F(ri) - ei - G,(ti, ri)) holds. Subsequently, the verifier algorithm V verifies whether or not the equality of ci = H(ti , ri, ui) holds. Subsequently, the verifier algorithm V verifies whether or not the equality of c4 = H(ui, ei) holds. The verifier algorithm V outputs the value 1 to indicate 20 authentication success in the case where the verifications all succeed, and outputs the value 0 to indicate authentication failure in the case where a verification fails. [0140] The example of the extended algorithm structure related to the 3-pass scheme has been described above. By using the algorithms, the data size necessary 25 for communication is considerably reduced. Also, using the cubic polynomial enables realization of higher security. [0141] (2-3-2: Parallelized Algorithm (FIG. 8)) Next, a method of parallelizing extended algorithms related to the 3-pass 30 scheme will be described with reference to FIG. 8. However, further description of the structure of the key generation algorithm Gen will be omitted.

SP336112WO00 46/121 [0142] Operation #1: As illustrated in FIG. 8, the prover algorithm P executes the following processes for i = 1 to N. First, the prover algorithm P randomly generates the 5 vectors roi, toi, uoi that are elements of the set K", and the vector e 0 i that is an element of the set K'. Subsequently, the prover algorithm P calculates rii <- s - roi. This calculation is equivalent to masking the secret key s with the vector r 0 . Subsequently, the prover algorithm P calculates t 1 i <- roi - toi. Subsequently, the prover algorithm P calculates uii <- rii - uoi. Subsequently, the prover algorithm P 10 calculates e 1 i <- F(ri) - e 0 i. [0143] Operation #1 (continued): Subsequently, the prover algorithm P calculates c 0 i <- H(r 1 , Gx(toi, r 1 ) + eoi). Subsequently, the prover algorithm P calculates cii <- H(roi, - toi, uoi). Subsequently, 15 the prover algorithm P calculates c2i <- H(roi, e 1 i - Gy(roi, u 1 )). Subsequently, the prover algorithm P calculates c 3 i <- H(toi, eoi). Subsequently, the prover algorithm P calculates c4i <- H(u 1 , e 1 ). After generating (coi, C 11 , c21, c3 1 , c4 1 , ... , coN, ClN, C2N, c3N, C4N), the prover algorithm P calculates the hash value Cmt <- H(coi, cn, c2 1 , c3 1 , C41, ... , coN, ClN, C2N, C3N, C4N) 20 [0144] The hash value Cmt generated in operation #1 is sent to the verifier algorithm V. [0145] Operation #2: 25 Upon receiving the hash value Cmt, the verifier algorithm V selects which verification pattern to use from among four verification patterns, for each of i = 1 to N. For example, the verifier algorithm V may, for each of i = 1 to N, select a numerical value from among four numerical values 10, 1, 2, 31 representing verification patterns, and set the selected numerical value in a challenge Chi. The 30 challenge Chi (i = 1 to N) is sent to the prover algorithm P. [0146] SP336112WO00 47/121 Operation #3: Upon receiving the challenge Chi (i = 1 to N), the prover algorithm P generates responses Rspi for each of i = 1 to N to send to the verifier algorithm V in response to each of the received challenge Chi. In the case where Chi = 0, the 5 prover algorithm P generates a response Rspi = (roi, toi, uoi, efi, coi, c41). In the case where Chi = 1, the prover algorithm P generates a response Rspi = (roi, u 1 , e 1 , coi, cii, c 3 1). In the case where Chi = 2, the prover algorithm P generates a response Rspi = (rii, toi, efi, cii, c2i, c41). In the case where Chi = 3, the prover algorithm P generates a response Rspi = (r 1 , tii, uii, eii, c2i, c31). The response Rspi (i = 1 to N) generated 10 in operation #3 is sent to the verifier algorithm V. [0147] Operation #4: Upon receiving the response Rspi (i = 1 to N), the verifier algorithm V executes the following process for i = 1 to N using the received response Rsp. 15 [0148] In the case where Chi = 0, the verifier algorithm V calculates cii = H(roi - toi, uoi). Subsequently, the verifier algorithm V calculates c2i = H(roi, F(roi) + Gy(roi, uoi) - eoi). Subsequently, the verifier algorithm V calculates c3i = H(toi, eoi). The verifier algorithm V then stores (coi, cii, c 2 i, c 3 1, c 4 1). 20 [0149] In the case where Chi = 1, the verifier algorithm V calculates c2i = H(roi, e 1 i Gy(roi, u 1 )). Subsequently, the verifier algorithm V calculates c 4 1 = H(uii, e 1 i). Subsequently, the verifier algorithm V calculates c3i = H(ti, eoi). The verifier algorithm V then stores (coi, cii, c2i, c31, c41). 25 [0150] In the case where Chi = 2, the verifier algorithm V calculates coi = H(rii, Gx(toi, r 1 ) + eoi). Subsequently, the verifier algorithm V calculates c3i = H(toi, eoi). Subsequently, the verifier algorithm V calculates c 3 1 = H(ti, eoi). The verifier algorithm V then stores (coi, cii, c2i, c31, c41). 30 [0151] In the case where Chi = 3, the verifier algorithm V calculates coi = H(rii, y - SP336112WO00 48/121 F(rii) - e 1 i - Gx(tii, r 1 )). Subsequently, the verifier algorithm V calculates cii H(tii,rii - uii). Subsequently, the verifier algorithm V calculates c4i = H(uii, eii). The verifier algorithm V then stores (coi, cii, c2i, c31, c41). [0152] 5 After executing the above processes for i = 1 to N, the verifier algorithm V verifies whether or not the equality of Cmt = H(coi, el, c21, c3 1 , c4 1 , ... , coN, ClN, C2N, c3N, C4N) holds. The verifier algorithm V outputs the value 1 to indicate authentication success in the case where the verification succeeds, and outputs the value 0 to indicate authentication failure in the case where a verification fails. 10 [0153] The parallelization of the extended algorithm structure related to the 3-pass scheme has been described above. By using the algorithms, the data size necessary for communication is considerably reduced. Also, using the cubic polynomial enables realization of higher security. 15 [0154] <3: Algorithm Structure Related to 5-pass Public-key Authentication Scheme> Hereinafter, algorithms related to a 5-pass public-key authentication scheme will be described. Note that in the following description, a 5-pass public-key 20 authentication scheme may also be referred to as a "5-pass scheme" in some cases. [0155] In the case of the 3-pass scheme, the probability of the false verification is 2/3 per time of the interactive protocol. However, in the case of the 5-pass scheme, the probability of the false verification per time of the interactive protocol is 1/2 + 25 1/q. Here, q is an order of a ring to be used. Accordingly, when the order of the ring is sufficiently large, the probability of the false verification per time of the 5 pass scheme can be reduced, and thus the probability of the false verification can be sufficiently reduced by executing the interactive protocol a small number of times. [0156] 30 For example, when the probability of the false verification is desired to be equal to or less than 1/2", the interactive protocol has to be executed n/(log3 - 1) = SP336112WO00 49/121 1.701n times or more in the 3-pass scheme. On the other hand, when the probability of the false verification is desired to be equal to or less than 1/2", the interactive protocol has to be executed n/(1 - log(1 + 1/q)) times or more in the 5 pass scheme. Accordingly, when q = 24, a communication quantity necessary to 5 realize the same security level is less in the 5-pass scheme than in the 3-pass scheme. [0157] [3- 1: Example of Specific Algorithm Structure (FIG. 9)] First, an example of a specific algorithm structure related to the 5-pass scheme will be introduced with reference to FIG. 9. FIG. 9 is an explanatory 10 diagram for describing a specific algorithm structure related to the 5-pass scheme. An algorithm of the 5-pass scheme is made up of a key generation algorithm Gen, a prover algorithm P, and a verifier algorithm V. Hereinafter, each algorithm structure will be described. [0158] 15 (Key Generation Algorithm Gen) The key generation algorithm Gen generates multivariate polynomials fi(x1, ... , x.), ... , fm(xi, ..., x.) defined in a ring k and a vector s = (si, ..., s") that is an element of a set K". Next, the key generation algorithm Gen calculates y = (yi, ..., ym) <- (fi(s), ..., fm(s)). Also, the key generation algorithm Gen sets (fi ..., fn, y) in 20 the public key pk and sets s as a secret key. Hereinafter, a vector (x1, ... , x') is represented as x and a pair of multivariate polynomials (fi(x), ..., fm(x)) is represented as F(x). [0159] (Prover Algorithm P, Verifier Algorithm V) 25 Next, processes performed by the prover algorithm P and the verifier algorithm V during the interactive protocol will be described with reference to FIG. 9. [0160] Operation #1: As illustrated in FIG. 9, the prover algorithm P randomly selects a number 30 seed. Subsequently, the prover algorithm P generates a vector ro which is an element of the set K" and a pair of multivariate polynomials F1(x) = (fli(x), ..., fim(x)) SP336112WO00 50/121 by applying the number seed to a pseudo-random number generator PRNG. That is, the prover algorithm P calculates (ro, F 1 ) <- G(seedo). Subsequently, the prover algorithm P calculates rl <- s - ro. This calculation is equivalent to masking the secret key s with the vector ro. 5 [0161] Operation #1 (continued): Subsequently, the prover algorithm P generates F 1 (ri) and a hash value co of ri. That is, the prover algorithm P calculates co <- H(F 1 (ri), ri). Also, the prover algorithm P generates a hash value ci of the number seed. That is, the prover 10 algorithm P calculates ci <- H(seedo). The messages (co, ci) generated in operation #1 are sent to the verifier algorithm V. [0162] Operation #2: Upon receiving the messages (co, ci), the verifier algorithm V randomly 15 selects one number ChA from the origins of q rings K and sends the selected number ChA to the prover algorithm P. [0163] Operation #3: Upon receiving the number ChA, the prover algorithm P calculates F 2 (x) < 20 ChA - F(x + ro) + F 1 (x). This calculation is equivalent to masking the multivariate polynomial F(x+ro) for x with the multivariate polynomial F 1 (x). The multivariate polynomial F 2 generated in operation #3 is sent to the verifier algorithm V. [0164] Operation #4: 25 Upon receiving the multivariate polynomial F 2 , the verifier algorithm V selects which verification pattern to use from between two verification patterns. For example, the verifier algorithm V may select a numerical value from between two numerical values 10, 11 representing verification patterns, and set the selected numerical value in a challenge ChB. This challenge ChB is sent to the prover 30 algorithm P. [0165] SP336112WO00 51/121 Operation #5: Upon receiving the challenge ChB, the prover algorithm P generates a response Rsp to send to the verifier algorithm V in response to the received challenge ChB. In the case where ChB = 0, the prover algorithm P generates a response Rsp = 5 seedo. In the case where ChB = 1, the prover algorithm P generates a response Rsp = ri. The response Rsp generated in operation #5 is sent to the verifier algorithm V. [0166] Operation #6: Upon receiving the response Rsp, the verifier algorithm V executes the 10 following verification process using the received response Rsp. [0167] In the case where ChB = 0, the verifier algorithm V calculates (ro, F 1 ) < PRNG(Rsp). Then, the verifier algorithm V verifies whether or not the equality of ci = H(Rsp) holds. In addition, the verifier algorithm V verifies whether or not the 15 equality of F 2 (x) = ChA - F(F(x + ro) + F 1 (x) holds. The verifier algorithm V outputs the value 1 to indicate authentication success in the case where these verifications all succeed, and outputs the value 0 to indicate authentication failure in the case where a verification fails. [0168] 20 In the case where ChB = 1, the verifier algorithm V sets ri <- Rsp. Also, the verifier algorithm V verifies whether or not the equality of co = H(F 2 (ri) - ChA ' Y, ri) holds. The verifier algorithm V outputs the value 1 to indicate authentication success in the case where these verifications all succeed, and outputs the value 0 to indicate authentication failure in the case where a verification fails. 25 [0169] (Soundness) The soundness of the 5-pass scheme is ensured from the fact that F 1 , F 2 , F 2 ', ro, and ri satisfying the following formula (28) to formula (30) can be calculated from the content of a response when the prover algorithm P appropriately makes the 30 response to the challenge ChB = 0 and 1 with respect to (co, ci) and two (ChA, ChA') selected by the verifier algorithm V SP336112WO00 52/121 [0170] [Math 15] (2 8) F2(x)= Ch.F(x+r.)+ F(x) F2(r)- Ch y =F r )-Chy [0171] 5 By ensuring the foregoing soundness of the 5-pass scheme, the fact that forgery with a probability higher than 1/2 + 1/q is not possible is ensured as long as the problem of solving the multi-order multivariate simultaneous equations is not solved. That is, to appropriately make the response to all of the challenges ChA = 0 and 1 of the verifier, the falsifier has to calculate F 1 , F 2 , F 2 , ro, and ri satisfying the 10 foregoing formula (28) and formula (30). In other words, the falsifier has to calculate s satisfying F(s) = y. Accordingly, the falsifier may not succeed the forgery with a probability higher than 1/2 + 1/q as long as the problem of solving the multi-order multivariate simultaneous equations is not solved. Further, by repeatedly executing the foregoing interactive protocol a sufficiently large number of 15 times, the probability of a successful forgery becomes negligibly small. [0172] (Hash Function H) Here, the description of a hash function H will be supplemented. In the foregoing algorithms, co, ci, and the like are calculates using the hash function H. 20 However, a commitment function COM may be used instead of the hash function H. The commitment function COM is a function in which a character string S and a random number p are factors. An example of the commitment function includes a scheme published in the international conference CRYPTO 1996 by Shai Halevi and SP336112WO00 53/121 Silvio Micali. [0173] For example, a case in which co and ci are calculated using the commitment function COM will be considered. In this case, random numbers po and pi are 5 prepared before co and ci are calculated, and co, ci are generated by applying commitment functions COM(.,po) and COM(.,pi), instead of applying the hash function H(-). Further, pi necessary for the verifier to generate ci is set to be included in the response Rsp and be sent. [0174] 10 The example of the specific algorithm structure related to the 5-pass scheme has been described above. [0175] [3-2: Efficient Algorithm Based on Quadratic Multivariate Polynomial} Next, a method of making the algorithms related to the 5-pass scheme 15 efficient will be described. Here, a case in which a pair of quadratic polynomials (fi(x), ..., fm(x)) are used as multivariate polynomials F will be described. [0176] As in the efficient algorithms related to the 3-pass scheme, two vectors, i.e., the vector to that is an element of the set K" and the vector eo that is an element of the 20 set K' are used to express the multivariate polynomial F1(x), which is used to mask the multivariate polynomial F(x + ro), as F1(x) = G(x, to) + eo. When this expression is used, a relation expressed in the following formula (31) can be obtained for the multivariate polynomial F(x + ro). [0177] 25 [Math 16] Ch 4 F(x +r)+T (x) =Ch F(x)+Ch F(r )+Chr G =Ch rF(x)+G(x,Ch) r+ t 0 )+Ch +Fe)+e (3 1) [0178] SP336112WO00 54/121 For this reason, when ti = ChA ' ro + to, el = ChA - F(ro) + eo, the multivariate polynomial F 2 (x)= ChA -F(x + ro) + F 1 (x) after the masking can also be expressed by two vectors, i.e., the vector ti which is an element of the set K" and the vector ei that is an element of the set K'. For this reason, when "F 1 (x) = G(x, to) + eo" is set, F 1 5 and F 2 can be expressed by using a vector in K" and a vector in K', and thus a data size necessary for communication can be considerably reduced. Specifically, communication cost can be reduced to the degree of thousands to tens of thousands of times. [0179] 10 Through the foregoing modification, information on ro is not at all leaked from F 2 (or F 1 ). For example, even when ei and ti (or eo and to) are given, the information on ro is not known at all as long as eo and to (or ei and ti) are not known. Accordingly, the zero knowledge is ensured. Hereinafter, an efficient algorithm related to the 5-pass scheme will be described with reference to FIGS. 10 and 11. 15 [0180] (3-2-1: Basic Structure (FIG. 10)) First, a basic structure of an efficient algorithm related to the 5-pass scheme will be described with reference to FIG. 10. However, further description of the structure of the key generation algorithm Gen will be omitted. 20 [0181] Operation #1: As illustrated in FIG. 10, the prover algorithm P randomly generates the vector ro that is an element of the set K", the vector to that is an element of the set K", and the vector eo that is an element of the set K'. Subsequently, the prover 25 algorithm P calculates ri <- s - ro. This calculation is equivalent to masking the secret key s with the vector ro. Subsequently, the prover algorithm P calculates the hash value co of the vectors ro, to, eo. That is, the prover algorithm P calculates co < H(ro, to, eo). Subsequently, the prover algorithm P generates G(to, ri) + eo and the hash value ci of ri. That is, the prover algorithm P calculates co <- H(ri, G(to, ri) + 30 eo). The messages (co, ci) generated in operation #1 is sent to the verifier algorithm

V.

SP336112WO00 55/121 [0182] Operation #2: Upon receiving the messages (co, ci), the verifier algorithm V randomly selects one number ChA from the origins of q rings K and sends the selected number 5 ChA to the prover algorithm P. [0183] Operation #3: Upon receiving the number ChA, the prover algorithm P calculates ti <- ChA ro - to. Additionally, the prover algorithm P calculates ei <- ChA - F(ro) - eo. The 10 prover algorithm P sends ti and ei to the verifier algorithm V. [0184] Operation #4: Upon receiving ti and ei, the verifier algorithm V selects which verification pattern to use from between two verification patterns. For example, the verifier 15 algorithm V may select a numerical value from between two numerical values {0, 11 representing verification patterns, and set the selected numerical value in a challenge ChB. This challenge ChB is sent to the prover algorithm P. [0185] Operation #5: 20 Upon receiving the challenge ChB, the prover algorithm P generates a response Rsp to send to the verifier algorithm V in response to the received challenge ChB. In the case where ChB = 0, the prover algorithm P generates a response Rsp = ro. In the case where ChB = 1, the prover algorithm P generates a response Rsp = ri. The response Rsp generated in operation #5 is sent to the verifier algorithm V. 25 [0186] Operation #6: Upon receiving the response Rsp, the verifier algorithm V executes the following verification process using the received response Rsp. [0187] 30 In the case where ChB = 0, the verifier algorithm V executes ro <- Rsp. Then, the verifier algorithm V verifies whether or not the equality of co = H(ro, ChA ' SP336112W00 56/121 ro - ti, ChA. F(ro) - ei) holds. The verifier algorithm V outputs the value 1 to indicate authentication success in the case where these verifications all succeed, and outputs the value 0 to indicate authentication failure in the case where a verification fails. 5 [0188] In the case where ChB = 1, the verifier algorithm V executes ri <- Rsp. Then, the verifier algorithm V verifies whether or not the equality of ci = H1(ri, ChA ' (y - F(ri) - G(ti, ri) - ei) holds. The verifier algorithm V outputs the value 1 to indicate authentication success in the case where these verifications all succeed, and 10 outputs the value 0 to indicate authentication failure in the case where a verification fails. [0189] The example of the efficient algorithm structure related to the 5-pass scheme has been described above. By using the algorithms, the data size necessary 15 for communication is considerably reduced. [0190] (3-2-2: Parallelized Algorithm (FIG. 11)) Next, a method of parallelizing the efficient algorithms illustrated in FIG. 10 will be described with reference to FIG. 11. However, further description of the 20 structure of the key generation algorithm Gen will be omitted. [0191] As described above, applying the above interactive protocol related to the 5 pass scheme makes it possible to keep the probability of a successful forgery to (1/2 + 1/q) or less. Consequently, executing the interactive protocol twice makes it 25 possible to keep the probability of a successful forgery to (1/2 + 1/q) 2 or less. Furthermore, if the interactive protocol is executed N times, the probability of a successful forgery becomes (1/2 + 1/q)N , and if N is set to a sufficiently large number (N = 80, for example), the probability of a successful forgery becomes negligibly small. 30 [0192] Conceivable methods of executing an interactive protocol multiple times SP336112WO00 57/121 include a serial method in which the exchange of message, challenge, and response is sequentially repeated multiple times, and a parallel method in which multiple messages, challenges, and responses are exchanged in a single exchange, for example. Here, algorithms that execute the above interactive protocol related to the 5 5-pass scheme in parallel (hereinafter designated parallelized algorithms) will now be described. [0193] Operation #1: The prover algorithm P first executes the following processes (1) to (4) for i 10 1 to N. Process (1): The prover algorithm P randomly generates the vectors roi, toi that are elements of the set K", and the vector e 0 i that is an element of the set K'. Process (2): The prover algorithm P calculates r 1 i <- s - r 0 . This calculation is equivalent to masking the secret key s with the vector r 0 . 15 Process (3): The prover algorithm P calculates c 0 i <- H(ri, toi, eO). Process (4): The prover algorithm P calculates cli <- H(rii, G(toi, r 1 ) + eoi). After executing the above processes (1) to (4) for i = 1 to N, the prover algorithm P executes the hash value Cmt <- H(coi, el, ... , coN, ClN). The hash value Cmt generated in operation #1 is sent to the verifier algorithm V. 20 [0194] Operation #2: Upon receiving the hash value Cmt, the verifier algorithm V randomly selects one number ChAi from the origins of q rings K for i = 1 to N and sends the selected number ChAi (i = 1 to N) to the prover algorithm P. 25 [0195] Operation #3: Upon receiving the number ChAi (i = 1 to N), the prover algorithm P calculates tii <- ChAi roi - toi for i = 1 to N. Additionally, the prover algorithm P calculates eii <- ChAi F(ri) - e 0 i for i = 1 to N. Then, the prover algorithm P sends 30 t 1 u, ... , tlN and ell, --- , elN to the verifier algorithm V. [0196] SP336112WO00 58/121 Operation #4: Upon receiving tu, ... , tlN and ell, --- , elN, the verifier algorithm V selects which verification pattern to use from between two verification patterns for i = 1 to N. For example, the verifier algorithm V may select a numerical value from 5 between two numerical values {0, 11 representing verification patterns, and set the selected numerical value in a challenge ChBi. This challenge ChB (i = 1 to N) is sent to the prover algorithm P. [0197] Operation #5: 10 Upon receiving the challenge ChB (i = 1 to N), the prover algorithm P generates a response Rspi to send to the verifier algorithm V in response to the received challenge ChBi for i = 1 to N. In the case where ChBi = 0, the prover algorithm P generates a response Rspi = (roi, cii). In the case where ChBi = 1, the prover algorithm P generates a response Rspi = (rii, coi). The response Rspi (i = 1 to 15 N) generated in operation #5 is sent to the verifier algorithm V. [0198] Operation #6: Upon receiving the response Rspi (i = 1 to N), the verifier algorithm V executes the following processes (1) and (2) using the received response Rspi (i = 1 20 to N). [0199] Process (1): In the case where ChBi = 0, the verifier algorithm V executes (roi, cii) <- Rspi. Then, the verifier algorithm V calculates c 0 i = H(ri - ChAi ' roi - tli, ChAi - F(roi) - e 1 ). The verifier algorithm V then stores (coi, cii). 25 [0200] Process (2): In the case where ChBi = 1, the verifier algorithm V executes (rii, coi) <- Rspi. Then, the verifier algorithm V calculates cii = H(ri, - ChAi - (y - F(r 1 )) - G(tii, r 1 ) - e 1 ). The verifier algorithm V then stores (coi, cii). [0201] 30 After executing the processes (1) and (2) for i = 1 to N, the verifier algorithm V verifies whether or not the equality of Cmt = H(coi, el, ..., coN, ClN) SP336112WO00 59/121 holds. The verifier algorithm V outputs the value 1 to indicate authentication success in the case where these verifications succeed, and outputs the value 0 to indicate authentication failure in the case where a verification fails. [0202] 5 The example of the structures of the parallelized efficient algorithms related to the 5-pass scheme has been described above. Also, the parallelized algorithms shown in FIG. 11 include the contrivance in which the message is converted into the hash value before being sent. The contrivance improves communication efficiency. Similarly, the structure may be modified such that the challenges ChAl, ..., ChAN, 10 ChB1, ..., ChBN or the responses Rspi, ..., RspN are converted into hash values before being sent. Modifying the structure in this way enables a further improvement in the communication efficiency to be expected. [0203] [3-3: Efficient Algorithm Based on High-order Multivariate Polynomial 15 (Scheme #1)] The foregoing efficient algorithms use the property in that the polynomial G defined in the foregoing formula (10) becomes bilinear by expressing the multivariate polynomial F with the pair of quadratic polynomials fi defined in the foregoing formula (8). Here, the efficient algorithm illustrated in FIG. 10 uses the 20 fact that the public key F(s) can be divided into a portion in which a term which is ChA times is dependent on ChA and another portion. However, even in the case of the 5-pass scheme, when the polynomial G is linear for at least one of x and y, an efficient algorithm can be constructed likewise even when the polynomial G is not bilinear. 25 [0204] (Construction of Efficient Algorithm Using Cubic Polynomial fi) A method of constructing an efficient algorithm using a cubic polynomial fi of a ring R will be examined as in the case of the 3-pass scheme. When a cubic polynomial fi is expressed as in the foregoing formula (17), the fact that Gx(x, y) and 30 Gy(x, y) become linear for x and y can be understood from formula (19) and formula (20).

SP336112WO00 60/121 [0205] Thus, using the foregoing property, the public key F(s) is divided into a term which is ChA times by introducing new variables ro, ri, to, uo, and eo. Since polynomials G, and Gy are linear for x and y, a relation among the following formula 5 (32) to formula (35) is established using the variables ro, ri, to, uo, and eo. The following formula (32) to formula (35) can be divided into a first portion dependent on ChA and a second portion not dependent on ChA. Here, the first portion can be reproduced with (ri, ti, ui, ei). The second portion can be reproduced with (ro, ti, ui, el). 10 [0206] For example, "eo, Gx(to, ri)" included in the following formula (32), "to" included in the following formula (33), "uo" included in the following formula (34), and "eo, Gy(ro, uo)" included in the following formula (35) are the first portions. On the other hand, "ChAi -F(ro + ri), ei, ChA -F(ri), Gx(ti, ri)" included in the following 15 formula (32), "ChA ' ro, t 1 " included in the following formula (33), "ChA ' rl, ul" included in the following formula (34), and "ChA - F(ro), Gy(ro, ui), ei" included in the following formula (35) are the second portions. [0207] From the definition of the secret key s and the relation among the following 20 formula (32) to formula (35), the fact the secret key s is not obtainable is ensured even when any one of (ri, ti, ui, ei) and (ro, ti, ui, ei) is used. Using this property enables, for example, the construction of an efficient algorithm (hereinafter, an extended algorithm) related to the 5-pass scheme using the cubic polynomial fi of the ring R. 25 [0208] [Math 17] SP336112WO00 61/121 ChA- F(r 0 +±Ij) =zen +e, +ChA -F(IJ)+G,(fltj~)+G,(t5r) Ch -s=o t - ( 3 I'l) C -F(r 0 ) ± ,(o i + GQ) I e 0 , +ce, [0209] Hereinafter, an example of a specific extended algorithm structure will be described. Two basic points regarding design of an extended algorithm are that a 5 message expressed in the following formula (36) and formula (37) is sent to a verifier and that a portion (first portion) dependent on ChA is verified for ChA selected by the verifier. Here, since "ro and ri used at the time of generation of a message are prevented from being substituted with other ro and ri at the time of verification," an example of a structure to which the verification on ro and ri is added 10 will be introduced below. [0210] [Math 18] c 0 =HQt, eG - G,(reu 0 )) (3 6) c H H(uoIG,(t ,r")+ e,) (3 7) [0211] 15 (3-3-1: Basic Structure (FIG. 12)) First, a basic structure of an extended algorithm related to the 5-pass scheme will be described with reference to FIG. 12. However, further description of the SP336112WO00 62/121 structure of the key generation algorithm Gen will be omitted. [0212] Operation #1: As illustrated in FIG. 12, the prover algorithm P randomly generates the 5 vectors ro, to, uo that are elements of the set K", and the vector eo that is an element of the set K'. Subsequently, the prover algorithm P calculates ri <- s - ro. This calculation is equivalent to masking the secret key s with the vector ro. Subsequently, the prover algorithm P calculates co <- H(ro, to, eo - Gy(ro, uo)). Subsequently, the prover algorithm P calculates ci <- H(ri, uo, Gx(to, ri) + eo). 10 Messages (co, ci) generated in operation #1 are sent to the verifier algorithm V. [0213] Operation #2: Upon receiving the messages (co, ci), the verifier algorithm V randomly selects a number ChA. The number ChA is sent to the prover algorithm P. 15 [0214] Operation #3: Upon receiving the number ChA, the prover algorithm P calculates ti <- ChA ro - to. Subsequently, the prover algorithm P calculates ui <- ChA 'r 1 -- uo. Subsequently, the prover algorithm P calculates ei <- ChA - F(ro) + ChA - Gy(ro, rl) 20 eo. Then, (ti, ui, ei) generated in operation #3 is sent to the verifier algorithm V. [0215] Operation #4: Upon receiving (ti, ui, ei), the verifier algorithm V selects which verification pattern to use from between two verification patterns. For example, the 25 verifier algorithm V may select a numerical value from between two numerical values {0, 11 representing verification patterns, and set the selected numerical value in a challenge ChB. This challenge ChB is sent to the prover algorithm P. [0216] Operation #5: 30 Upon receiving the challenge ChB, the prover algorithm P generates a response Rsp to send to the verifier algorithm V in response to the received challenge SP336112WO00 63/121 ChB. In the case where ChB = 0, the prover algorithm P generates a response Rsp = ro. In the case where ChB = 1, the prover algorithm P generates a response Rsp = ri. The response Rsp generated in operation #5 is sent to the verifier algorithm V. [0217] 5 Operation #6: Upon receiving the response Rsp, the verifier algorithm V executes the following verification process using the received response Rsp. [0218] In the case where ChB = 0, the verifier algorithm V verifies whether or not 10 the equality of co = H(rO, ChA ro - t 1 , ChA - F(ro) + Gy(ro, ui) - ei) holds. The verifier algorithm V outputs the value 1 to indicate authentication success in the case where these verifications succeed, and outputs the value 0 to indicate authentication failure in the case where a verification fails. [0219] 15 In the case where ChB = 1, the verifier algorithm V verifies whether or not the equality of ci = H(ri, ChA ' r 1 - ul, ChA - (y - F(ri)) - Gx(ti, ri) - ei) holds. The verifier algorithm V outputs the value 1 to indicate authentication success in the case where these verifications succeed, and outputs the value 0 to indicate authentication failure in the case where a verification fails. 20 [0220] The example of the extended algorithm structure related to the 5-pass scheme has been described above. By using the algorithms, the data size necessary for communication is considerably reduced. Also, using the cubic polynomial enables realization of higher security. 25 [0221] (3-3-2: Parallelized Algorithm (FIG. 13)) Next, a method of parallelizing extended algorithms related to the 5-pass scheme will be described with reference to FIG. 13. However, further description of the structure of the key generation algorithm Gen will be omitted. 30 [0222] Operation #1: SP336112WO00 64/121 As illustrated in FIG. 13, the prover algorithm P executes the following processes for i = 1 to N. First, the prover algorithm P randomly generates the vectors roi, toi, uoi that are elements of the set K", and the vector e 0 i that is an element of the set K'. Subsequently, the prover algorithm P calculates rii <- s - roi. This 5 calculation is equivalent to masking the secret key s with the vector r 0 . Subsequently, the prover algorithm P calculates c 0 i <- H(ri, toi, eoi, - Gy(roi, uoi)). Subsequently, the prover algorithm P calculates cii <- H(rii, uoi - Gx(toi, r 1 ) + eoi). [0223] Operation #1 (continued): 10 After calculating (coi, el, ..., coN, ClN), the prover algorithm P calcualtes Cmt <- H(coi, el, ..., coN, ClN). The hash value Cmt generated in operation #1 is sent to the verifier algorithm V. [0224] Operation #2: 15 Upon receiving the hash value Cmt, the verifier algorithm V randomly selects numbers ChAl, ..., ChAN. The numbers ChAl, ..., ChAN are sent to the prover algorithm P. [0225] Operation #3: 20 Upon receiving the numbers ChAl, ..., ChAN, the prover algorithm P executes the following process for i = 1 to N. First, the prover algorithm P calculates t 1 i < ChAi ' r 0 i - toi. Subsequently, the prover algorithm P calculates uii <- ChAi ' rli - uoi. Subsequently, the prover algorithm P calculates eii <- ChAi - F(roi) + ChAi - Gy(roi, r 1 u) - e 0 i. 25 [0226] Then, (tul, unl, ell,..., tlN, ulN, elN) generated in operation #3 is sent to the verifier algorithm V. [0227] Operation #4: 30 Upon receiving (tul, unl, ell, ... , tlN, ulN, elN), the verifier algorithm V selects which verification pattern to use from between two verification patterns for i = 1 to SP336112WO00 65/121 N. For example, the verifier algorithm V may select a numerical value from between two numerical values {0, 11 representing verification patterns for i = 1 to N, and set the selected numerical value in a challenge ChBi. The challenges ChBi to ChBN are sent to the prover algorithm P. 5 [0228] Operation #5: Upon receiving the challenges ChB1 to ChBN, the prover algorithm P generates a response Rspi to send to the verifier algorithm V in response to the received challenge ChBi for i = 1 to N. In the case where ChBi = 0, the prover 10 algorithm P generates a response Rspi = (roi, c 1 i). In the case where ChBi = 1, the prover algorithm P generates a response Rspi = (r 1 , coi). The response Rspi generated in operation #5 is sent to the verifier algorithm V. [0229] Operation #6: 15 Upon receiving the response Rspi (i = 1 to N), the verifier algorithm V executes the following processes using the received response Rspi for i = 1 to N. [0230] In the case where ChBi = 0, the verifier algorithm V calculates coi = H(roi ChAi ' roi - t 1 , ChAi - F(roi) + Gy(roi, uii) - eii). The verifier algorithm V then stores 20 (coi, cii). [0231] In the case where ChBi = 1, the verifier algorithm V calculates cii = H(rii, ChAi ' rli - u 1 , ChAi - (y - F(rii)) - Gx(tii, r 1 ) - e 1 ). The verifier algorithm V then stores (coi, c 1 i). 25 [0232] After executing the foregoing processes for i = 1 to N, the verifier algorithm V verifies whether or not the equality of Cmt = H(coi, el, ... , coN, ClN) holds. The verifier algorithm V outputs the value 1 to indicate authentication success in the case where these verifications succeed, and outputs the value 0 to indicate authentication 30 failure in the case where a verification fails. [0233] SP336112WO00 66/121 The parallelization of the extended algorithm structure related to the 5-pass scheme has been described above. By using the algorithms, the data size necessary for communication is considerably reduced. Also, using the cubic polynomial enables realization of higher security. 5 [0234] [3-4: Efficient Algorithm Based on High-order Multivariate Polynomial (Scheme #2)] Hitherto, the method of constructing the efficient algorithm using the cubic polynomial fi of the ring R has been described. Here, a method of constructing an 10 extended algorithm using a high-order polynomial fi defined in a ring R of a characteristic q and an order qk will be considered. The high-order polynomial fi is expressed as in, for example, the following formula (38). When the high-order polynomial fi is used, a component gi of the polynomial G defined as G(x, y) F(x + y) - F(x) - F(y) (gi, ..., gm) is expressed as in the following formula (39). 15 [0235] [Math 19] g,(x x y ,* =(( a ) y [0236] A relation shown in the following formula (40) is established for ChA that is 20 an element of the set R. Additionally, a relation shown in the following formula (41) is also established. Thus, using this property (hereinafter, referred to as quasi linearity), the public key F(s) is divided into a term which is ChA times by introducing new variables ro, ri, toz, and e 0 . Since G has the quasi-linearity, a SP336112WO00 67/121 relation among the following formula (42) to formula (44) is established using the variables ro, ri, toz, and eo. The following formula (42) to formula (44) can be divided into a first portion dependent on ChA and a second portion not dependent on ChA. Here, the first portion can be reproduced with (ri, tiz, el). The second 5 portion can be reproduced with (ro, tiz, el). [0237] For example, "eo, EGz(toz, ri)" included in the following formula (42), "toz" included in the following formula (43), and "eo" included in the following formula (44) are the first portions. On the other hand, "ChA -F(ro + ri), ei, ChA -F(ri), 10 EGz(tiz, ri)" included in the following formula (42), "ChAq( z)' ro, t 1 z" (where q(z) qz and the same applies below) included in the following formula (43), and "ChA' F(ro), ei" included in the following formula (44) are the second portions. [0238] From the definition of the secret key s and the relation among the following 15 formula (42) to formula (44), the fact that the secret key s is not obtainable is ensured even when any one of (ri, t 1 z, el) and (ro, tiz, el) is used. Using this property enables, for example, the construction of an efficient algorithm (hereinafter, a high-order extended algorithm) related to the 5-pass scheme using the high-order polynomial fi of the ring R. 20 [0239] [Math 20] SP336112WO00 68/121 Ch, -G(x, y) G, (Chjf x, y) (4 0 G(x, + x, y) = G(x y) + G(x 2 ,y) (4 1) ChA -F(r + r) e) + e+ Ch F(r,) + Gz,(to r)+ G (t ri) (42', (Ch )*4 .o =to, + ti (4 3) Chi 4 -F(r)=e±+e, [0240] Hereinafter, an example of a specific high-order extended algorithm structure will be described. Two basic points regarding design of a high-order 5 extended algorithm are that a message expressed in the following formula (45) and formula (46) is sent to a verifier and that a portion (first portion) dependent on ChA is verified for ChA selected by the verifier. Here, since "ro and ri used at the time of generation of a message are prevented from being substituted with other ro and ri at the time of verification," an example of a structure to which the verification on ro and 10 ri is added will be introduced below. [0241] [Math 21] SP336112WO00 69/121 (4 5 ) c 1 = Ho G .(t r)+ e. 4 6 ) [0242] (3-4-1: Basic Structure (FIG. 14)) First, a basic structure of a high-order extended algorithm related to the 5 5 pass scheme will be described with reference to FIG. 14. However, further description of the structure of the key generation algorithm Gen will be omitted. [0243] Operation #1: As illustrated in FIG. 14, the prover algorithm P randomly generates the 10 vectors ro, toi, tok that are elements of the set K", and the vector eo that is an element of the set K'. Subsequently, the prover algorithm P calculates ri <- s - ro. This calculation is equivalent to masking the secret key s with the vector ro. Subsequently, the prover algorithm P calculates co <- H(ro, toi, ..., tok, eo). Subsequently, the prover algorithm P calculates ci <- H(ri, zGzto, ri) + eo) (where 15 Yz represents a sum for z = 1 to k). Messages (co, ci) generated in operation #1 are sent to the verifier algorithm V. [0244] Operation #2: Upon receiving the messages (co, ci), the verifier algorithm V randomly 20 selects a number ChA. The number ChA is sent to the prover algorithm P. [0245] Operation #3: Upon receiving the number ChA, the prover algorithm P calculates tiz < (ChA)q(z-1)' ro - toz for z = 1 to k. Subsequently, the prover algorithm P calculates ei SP336112WO00 70/121 <- ChA - F(ro) - eo. Then, (t1, ..., tik, ei) generated in operation #3 is sent to the verifier algorithm V. [0246] Operation #4: 5 Upon receiving (tul, ..., tik, ei), the verifier algorithm V selects which verification pattern to use from between two verification patterns. For example, the verifier algorithm V may select a numerical value from between two numerical values {0, 11 representing verification patterns, and set the selected numerical value in a challenge ChB. This challenge ChB is sent to the prover algorithm P. 10 [0247] Operation #5: Upon receiving the challenge ChB, the prover algorithm P generates a response Rsp to send to the verifier algorithm V in response to the received challenge ChB. In the case where ChB = 0, the prover algorithm P generates a response Rsp = 15 ro. In the case where ChB = 1, the prover algorithm P generates a response Rsp = ri. The response Rsp generated in operation #5 is sent to the verifier algorithm V. [0248] Operation #6: Upon receiving the response Rsp, the verifier algorithm V executes the 20 following verification process using the received response Rsp. [0249] In the case where ChB = 0, the verifier algorithm V verifies whether or not the equality of co = H(rO, (ChA('). ro - t 11 , ..., (ChA)q(k-1)' ro - t1k, ChA - F(ro) - ei) holds. The verifier algorithm V outputs the value 1 to indicate authentication 25 success in the case where these verifications succeed, and outputs the value 0 to indicate authentication failure in the case where a verification fails. [0250] In the case where ChB = 1, the verifier algorithm V verifies whether or not the equality of ci = H(ri, ChA - (y - F(ri)) - z ri)) holds. The verifier 30 algorithm V outputs the value 1 to indicate authentication success in the case where these verifications succeed, and outputs the value 0 to indicate authentication failure SP336112WO00 71/121 in the case where a verification fails. [0251] The example of the high-order extended algorithm structure related to the 5 pass scheme has been described above. By using the algorithms, the data size 5 necessary for communication is considerably reduced. Also, by using the high order polynomial, higher security is realized. [0252] (3-4-2: Parallelized Algorithm (Structure Example 1) (FIG. 15)) Next, a method of parallelizing high-order extended algorithms related to 10 the 5-pass scheme will be described with reference to FIG. 15. However, further description of the structure of the key generation algorithm Gen will be omitted. [0253] Operation #1: As illustrated in FIG. 15, the prover algorithm P executes the following 15 processes for i 1 to N. First, the prover algorithm P randomly generates the vectors roi, toii, ..., toki that are elements of the set K", and the vector e 0 i that is an element of the set K'. Subsequently, the prover algorithm P calculates r 1 i <- s - r 0 . This calculation is equivalent to masking the secret key s with the vector r 0 . Subsequently, the prover algorithm P calculates c 0 i <- H(roi, toii, ... , toki, eoi). 20 Subsequently, the prover algorithm P calculates cii <- H(rii, EzGztozi, r 1 ) + eoi) (where Yz represents a sum for z = 1 to k). The messages (coi, c 1 i) (where i = 1 to N) generated in operation #1 are sent to the verifier algorithm V. [0254] Operation #2: 25 Upon receiving the messages (coi, c 1 i) (where i = 1 to N), the verifier algorithm V randomly selects numbers ChAl, ..., ChA. The numbers ChAl, ..., ChA are sent to the prover algorithm P. [0255] Operation #3: 30 Upon receiving the numbers ChAl, ..., ChA, the prover algorithm P calculates t 1 zi <- (ChAi)q(z -1)' roi - tozi for i = 1 to N and z = 1 to k. Subsequently, the SP336112WO00 72/121 prover algorithm P calculates e 1 i <- ChAi - F(roi) - e 0 i. Then, (tii, ..., tiki, e 1 i) (where i = 1 to N) generated in operation #3 is sent to the verifier algorithm V. [0256] Operation #4: 5 Upon receiving (tii, ..., tiki, e 1 ) (where i = 1 to N), the verifier algorithm V selects which verification pattern to use from between two verification patterns for i = 1 to N. For example, the verifier algorithm V may select a numerical value from between two numerical values {0, 11 representing verification patterns for i = 1 to N, and set the selected numerical value in a challenge ChBi. The challenge ChBi (where 10 i = 1 to N) is sent to the prover algorithm P. [0257] Operation #5: Upon receiving the challenge ChBi (where i = 1 to N), the prover algorithm P generates a response Rspi to send to the verifier algorithm V in response to the 15 received challenge ChBi for i = 1 to N. In the case where ChBi 0, the prover algorithm P generates a response Rspi roi. In the case where ChBi 1, the prover algorithm P generates a response Rspi rii. The response Rspi (where i = 1 to N) generated in operation #5 is sent to the verifier algorithm V. [0258] 20 Operation #6: Upon receiving the response Rspi (i = 1 to N), the verifier algorithm V executes the following verification processes using the received response Rspi for i = 1 to N. [0259] 25 In the case where ChBi = 0, the verifier algorithm V verifies whether or not the equality of c 0 i = H(ri, (Ch () ro - t, (ChAi)q(k - 1)' r oi - tiki, ChAi - F(ri) - e 1 ) holds. In the case where ChBi = 1, the verifier algorithm V verifies whether or not the equality of cii= H(r, ChAi - (y - F(rii) - z r 1 )) holds. [0260] 30 The verifier algorithm V outputs the value 1 to indicate authentication success in the case where these verifications all succeed, and outputs the value 0 to SP336112WO00 73/121 indicate authentication failure in the case where a verification fails. [0261] The parallelization of the high-order extended algorithm related to the 5 pass scheme has been described above. By using the algorithms, the data size 5 necessary for communication is considerably reduced. Also, by using the high order polynomial, higher security is realized. [0262] (3-4-3: Parallelized Algorithm (Structure Example 2: High Efficiency) (FIG. 16)) 10 However, in the parallelized structure of the high-order extended algorithm illustrated in FIG. 15, the messages (coi, c 1 i) (where i = 1 to N) have been sent at the first pass without change. However, in consideration of communication efficiency, it is preferable that the messages (coi, c 1 i) (where i = 1 to N) be collectively sent with one hash value. In order to collectively send the messages (coi, c 1 i) (where i = 1 to 15 N) with one hash value at the first pass, the algorithm structure may be modified as illustrated in FIG. 16. [0263] In the example of the structure of FIG. 16, the prover algorithm P calculates the hash value Cmt <- H(coi, cn, ... , coN, ClN) in operation #1. Upon generating a 20 response Rspi in operation #5, the prover algorithm P generates a response Rspi= (roi, c 1 i) in the case where ChBi = 0 and generates a response Rspi = (rii, coi) in the case where ChBi 1. On the other hand, the verifier algorithm V generates (coi, cn, ..., coN, ClN) from (ChAi, ChBi, Rspi) (where i = 1 to N) in operation #6 and verifies whether or not the equality of Cmt = H(coi, c 1 , ..., coN, ClN) holds. Performing such 25 modification enables a further improvement in the communication efficiency. [0264] The efficient parallelized algorithm based on the high-order extended algorithms has been described above. [0265] 30 (3-4-4: Parallelized Algorithm (Structure Example 2: Higher Efficiency) (FIG. 17)) SP336112WO00 74/121 However, in the parallelized structure of the high-order extended algorithm illustrated in FIG. 15, the messages (coi, cli) (where i = 1 to N) have been sent at the first pass without change. Additionally, (tii, ..., tii, eii) (where i = 1 to N) have been sent at the third pass without change. However, in consideration of 5 communication efficiency, it is preferable that the messages (coi, cli) (where i = 1 to N) be collectively sent with one hash value. Additionally, it is preferable that (tli, ..., tiki, eii) (where i = 1 to N) be collectively sent with one hash value. In order to collectively send the messages (coi, cli) (where i = 1 to N) with one hash value at the first pass and collectively send (tii, ..., tii, eii) (where i = 1 to N) with one hash 10 value at the third pass, the algorithm structure may be modified as illustrated in FIG. 17. [0266] In the example of the structure of FIG. 17, the prover algorithm P calculates the hash value Cmt <- H(coi, el, ... , coN, ClN) in operation #1. The prover algorithm 15 P calculates the hash value CmtB <- H(tlli, ..., tlkN, en 1 , ..., elN) in operation #3. Upon generating a response Rspi in operation #5, the prover algorithm P generates a response Rspi (roi, to 0 1 , ..., toki, eoi, cii) in the case where Chai = 0 and generates a response Rspi (ru, t 1 ii, ..., tiki, e 1 , coi) in the case where Chi= 1. [0267] 20 On the other hand, the verifier algorithm V generates (coi, el, ..., coN, ClN) from (ChAi, Chi, Rspi) (where i = 1 to N) and (till, ... , tlkN, ell, ---, elN) in operation #6 and verifies whether or not the equality of CmtA = (col, C 11 , ... , CoN, ClN) and CmtB = (til, ... , tlkN, en 1 , ... , elN) holds. Performing such modification enables a further improvement in the communication efficiency. 25 [0268] The further efficient parallelized algorithm based on the high-order extended algorithms has been described above. [0269] By applying the high-order extended algorithm described above, an efficient 30 public-key authentication scheme having higher security can be realized. For example, when (q, n, m, N) = (24, 45, 30, 88) in an extended algorithm related to the SP336112WO00 75/121 5-pass scheme, the size of a public key is 120 bits, the size of a secret key is 180 bits, and the size of communication data is 27512 bits. [0270] For example, when the condition of (q, n, m, N) = (22, 42, 40, 118) is 5 satisfied in the case of a high-order extended algorithm related to the 5-pass scheme, the security is ensured to the same degree. Under this condition, the size of a public key is 80 bits, the size of a secret key is 84 bits, and the size of communication data is 27814 bits. That is, by applying a high-order extended algorithm, the size of communication data can be maintained to the same degree and the size of a public 10 key and the size of a secret key can be considerably reduced. [0271] The condition may be modified to (q, n, m, N) = (23, 28, 27, 97). In this case, the size of a public key is 81 bits, the size of a secret key is 84 bits, and the size of communication data is 27145 bits. Further, the condition may be modified to (q, 15 n, m, N) = (24, 21, 20, 88). In this case, the size of a public key is 80 bits, the size of a secret key is 84 bits, and the size of communication data is 28392 bits. Under any condition, considerable efficiency is achieved. [0272] <4: Modification of Digital Signature Scheme> 20 Here, a method of modifying the foregoing public-key authentication scheme into a digital signature scheme will be introduced. [0273] When a prover in a model of a public-key authentication scheme matches a signer in a digital signature scheme, an approximation to the model of the digital 25 signature scheme can easily be understood in that only a prover can convince a verifier. Based on this idea, a method of modifying the above-described public-key authentication scheme into a digital signature scheme will be descried. [0274] [4-1: Modification of 3-pass Public-key Authentication Scheme into Digital 30 Signature Scheme] First, modification of a public-key authentication scheme of 3-pass into a SP336112WO00 76/121 digital signature scheme will be described. [0275] (4-1-1: Digital Signature Algorithm (Structure Example 1) (FIG. 18)) As illustrated in FIG. 18, an efficient algorithm (for example, see FIGS. 6 5 and 8) related to the 3-pass scheme is expressed with interactivity of three times and four operations, i.e., operation #1 to operation #4. [0276] Operation #1 includes a process (1) of generating ai = (roi, toi, eoi, rii, tij, eii, coi, cii, c2i) and a process (2) of calculating Cmt <- H(coi, C 11 , c21, ... , coN, ClN, C2N). 10 Cmt generated in operation #1 by the prover algorithm P is sent to the verifier algorithm V. [0277] Operation #2 includes a process of selecting Chi, ..., ChN. Chi, ..., ChN selected in operation #2 by the verifier algorithm V are sent to the prover algorithm P. 15 [0278] Operation #3 includes a process of generating Rspi, ..., RspN using Chi, ChN and al ..., aN. This process is expressed as Rspi <- Select (Chi, ai). Rspi, RspN generated in operation #3 by the prover algorithm P are sent to the verifier algorithm V. 20 [0279] Operation #4 includes a process (1) of reproducing coi, C 1 1 , c2 1 , ... , coN, ClN, c2N using Chi, ..., ChN and Rspi, ..., RspN and a process (2) of verifying Cmt = H(coi,

C

11 , c21, ... , coN, ClN, C2N) using the reproduced coi, C 11 , c2 1 , ... , coN, ClN, C2N [0280] 25 The algorithm of the public-key authentication scheme expressed with the foregoing operation #1 to operation #4 is modified into a signature generation algorithm Sig and a signature verifying algorithm Ver illustrated in FIG. 18. [0281] (Signature Generation Algorithm Sig) 30 First, the structure of the signature generation algorithm Sig will be described. The signature generation algorithm Sig includes the following processes SP336112WO00 77/121 (1) to (5). [0282] Process (1): The signature generation algorithm Sig generates ai= (roi, toi, eoi, rii, tii, eii, coi, Cii, C2i). 5 Process (2): The signature generation algorithm Sig calculates Cmt <- H(coi, ecl, c21, ... , coN, ClN, C2N). Process (3): The signature generation algorithm Sig calculates (Chi, ..., ChN) <- H(M, Cmt). Here, M is a document to which a signature is attached. Process (4): The signature generation algorithm Sig calculates Rspi <- Select 10 (Chi, ai). Process (5): The signature generation algorithm Sig sets (Cmt, Rspi, RspN) as a signature. [0283] (Signature Verifying Algorithm Ver) 15 Next, the structure of the signature verifying algorithm Ver will be described. The signature verifying algorithm Ver includes the following processes (1) to (3). [0284] Process (1): The signature verifying algorithm Ver calculates (Chi, ..., ChN) <- H(M, Cmt). 20 Process (2): The signature verifying algorithm Ver generates c 01 , el, c2 1 , coN, ClN, C2N using Chi, ..., ChN and Rspi, ..., RspN Process (3): The signature verifying algorithm Ver verifies Cmt = H(coi, cn, c21, ... , coN, ClN, C2N) using the reproduced coi, el, c2 1 , ... , coN, ClN, C2N [0285] 25 As described above, by matching the prover in the model of the public-key authentication scheme with the signer in the digital signature scheme, the algorithm of the public-key authentication scheme can be modified into the algorithm of the digital signature scheme. [0286] 30 (4-1-2: Digital Signature Algorithm (Structure Example 2: High Efficiency) (FIG. 19)) SP336112WO00 78/121 However, when the structure of the signature generation algorithm Sig illustrated in FIG. 18 is focused on, it can be realized that calculation of a hash value has been performed in the processes (2) and (3). Further, when the structure of the signature verifying algorithm Ver is focused on, it can be realized that the same 5 calculation of a hash value as the process (3) of the signature generation algorithm Sig has been performed in the process (1). When the configurations of the signature generation algorithm Sig and the signature verifying algorithm Ver are improved focusing on these processes, as illustrated in FIG. 19, calculation efficiency can be further improved. 10 [0287] (Signature Generation Algorithm Sig) First, the structure of the improved signature generation algorithm Sig will be described with reference to FIG. 19. The signature generation algorithm Sig includes the following processes (1) to (4). 15 [0288] Process (1): The signature generation algorithm Sig generates ai= (roi, toi, eoi, rii, tii, eii, ci, cii, c2i). Process (2): The signature generation algorithm Sig calculates (Chi, ..., ChN) <- H(M, c 0 1 , C 11 , c 21 , ... , coN, ClN, C2N). Here, M is a document to which a signature 20 is attached. Process (3): The signature generation algorithm Sig calculates Rspi <- Select (Chi, ai). Process (4): The signature generation algorithm Sig sets (Chi, ..., ChN, Rspi, ..., RspN) as a signature. 25 [0289] (Signature Verifying Algorithm Ver) Next, the structure of the improved signature verifying algorithm Ver will be described. The signature verifying algorithm Ver includes the following processes (1) and (2). 30 [0290] Process (1): The signature verifying algorithm Ver generates c 01 , C 11 , c2 1

,

SP336112WO00 79/121 CON, CIN, C2N using Chi, ..., ChN and Rspi, ..., RsPN Process (2): The signature verifying algorithm Ver verifies (Chi, ..., ChN) H(coi, C 11 , C21, ... , CON, ClN, C2N) using the reproduced coi, C 1 1 , c2 1 , ... , CON, ClN, C2N [0291] 5 By improving the structures of the signature generation algorithm Sig and the signature verifying algorithm Ve, as described above, the calculation of a hash value in each algorithm is reduced by one time and calculation efficiency is thus improved. [0292] 10 [4-2: Modification of 5-pass Public-key Authentication Scheme into Digital Signature Scheme] Next, a modification of the public-key authentication scheme related to the 5-pass into a digital signature scheme will be described. [0293] 15 (4-2-1: Digital Signature Algorithm (Structure Example 1) (FIG. 20)) As illustrated in FIG. 20, an efficient algorithm (for example, see FIGS. 11, 13, and 16) related to the 5-pass scheme is expressed with interactivity of five times and six operations, i.e., operation #1 to operation #6. [0294] 20 Operation #1 includes a process (1) of generating ai = (roi, toi, eoi, rii, tij, eii, coi, c 1 i) for i = 1 to N and a process (2) of calculating Cmt <- H(coi, C1,..., CON, ClN). Cmt generated in operation #1 by the prover algorithm P is sent to the verifier algorithm V. [0295] 25 Operation #2 includes a process of selecting ChAl, ..., ChAN. ChAl, ChAN selected in operation #2 by the verifier algorithm V are sent to the prover algorithm P. [0296] Operation #3 includes a process of generating bi = (tii, e 1 ) for i = 1 to N. 30 Here, bi, ..., bN generated in operation #3 by the prover algorithm P are sent to the verifier algorithm V.

SP336112WO00 80/121 [0297] Operation #4 includes a process of selecting ChB1, ..., ChBN. ChB1, ChBN selected in operation #4 by the verifier algorithm V are sent to the prover algorithm P. 5 [0298] Operation #5 includes a process of generating Rspi, ..., RspN using ChB1, ChBN, al, ..., aN, b 1 , ... , bN. This process is expressed as Rspi <- Select (ChBi, ai, bi). Rspi, ..., RspN generated in operation #5 by the prover algorithm P are sent to the verifier algorithm V 10 [0299] Operation #6 includes a process (1) of reproducing coi, cn, ... , coN, ClN using ChAl, ..., ChAN, ChB1, ... , ChBN, Rspi, ..., RspN and a process (2) of verifying Cmt H(coi, cn, ... , coN, ClN using the reproduced coi, cn, ... , coN, ClN [0300] 15 The algorithm of the public-key authentication scheme expressed with the foregoing operation #1 to operation #6 is modified into a signature generation algorithm Sig and a signature verifying algorithm Ver illustrated in FIG. 20. [0301] (Signature Generation Algorithm Sig) 20 First, the structure of the signature generation algorithm Sig will be described. The signature generation algorithm Sig includes the following processes (1) to (7). [0302] Process (1): The signature generation algorithm Sig generates ai= (roi, toi, eoi, 25 rii, t 1 , e 1 , coi, c 1 i). Process (2): The signature generation algorithm Sig calculates Cmt <- H(coi, en, ... , coN, ClN). Process (3): The signature generation algorithm Sig calculates (ChAl, ChAN) <- H(M, Cmt). Here, M is a document to which a signature is attached. 30 Process (4): The signature generation algorithm Sig generates bi = (tii, e 1 ) for i= 1 to N.

SP336112WO00 81/121 Process (5): The signature generation algorithm Sig calculates (ChB1, ChBN) <- H(M, Cmt, ChAl, ... , ChA, bi, ..., bN). Additionally, modification into (ChB1, ... , ChBN) <- H(ChAl, ..., ChA, bi, ..., bN).may be performed. Process (6): The signature generation algorithm Sig calculates Rspi <- Select 5 (ChBi, ai, bi). Process (7): The signature generation algorithm Sig sets (Cmt, bi, ..., bN, Rspi, ..., RspN) as a digital signature. [0303] (Signature Verifying Algorithm Ver) 10 Next, the structure of the signature verifying algorithm Ver will be described. The signature verifying algorithm Ver includes the following processes (1) to (4). [0304] Process (1): The signature verifying algorithm Ver calculates (ChAl, ChAN) = H(M, Cmt). 15 Process (2): The signature verifying algorithm Ver calculates (ChB1, ChBN) = H(M, Cmt, ChAl, ..., ChA, bi, ..., bN). When modification into (ChB1, ChBN) = H(ChAl, ..., ChA, bi, ..., bN) is performed in the process (5) performed by the signature verifying algorithm Ver, the signature verifying algorithm Ver calculates (ChB1, ..., ChBN) = H(ChAl, ... , ChA, bi, ..., bN) 20 Process (3): The signature verifying algorithm Ver generates coi, cn, ... , cON, clN using ChAl, ... , ChA, ChB1, ... , ChBN, Rspi, ... , RspN Process (4): The signature verifying algorithm Ver verifies Cmt = H(coi, e, ... , coN, ClN) using the reproduced coi, cn, ... , cON, ClN [0305] 25 As described above, by matching the prover in the model of the public-key authentication scheme with the signer in the digital signature scheme, the algorithm of the public-key authentication scheme can be modified into the algorithm of the digital signature scheme. [0306] 30 (4-2-2: Digital Signature Algorithm (Structure Example 2: High Efficiency) (FIG. 21)) SP336112WO00 82/121 As illustrated in FIG. 21, a further efficient algorithm (for example, see FIG. 17) related to the 5-pass scheme is expressed with interactivity of five times and six operation #1 to operation #6. [0307] 5 Operation #1 includes a process (1) of generating ai = (roi, toi, eoi, rii, tij, eii, coi, c 1 i) for i = 1 to N and a process (2) of calculating CmtA <- H(coi, cn, ..., coN, ClN). CmtA generated in operation #1 by the prover algorithm P is sent to the verifier algorithm V. [0308] 10 Operation #2 includes a process of selecting ChAl, ..., ChAN. ChAl, ChAN selected in operation #2 by the verifier algorithm V are sent to the prover algorithm P. [0309] Operation #3 includes a process (1) of generating bi = (tii, e 1 ) and a process 15 (2) of calculating CmtB <- H (bi, ..., bN) for i = 1 to N. CmtB generated in operation #3 by the prover algorithm P are sent to the verifier algorithm V. [0310] Operation #4 includes a process of selecting ChBi, ..., ChBN. ChBi, ChBN selected in operation #4 by the verifier algorithm V are sent to the prover 20 algorithm P. [0311] Operation #5 includes a process of generating Rspi, ..., RspN using ChB1, ChBN, a ..., aN, bl ..., bN. This process is expressed as Rspi <- Select (ChBi, ai, bi). Rspi, ..., RspN generated in operation #5 by the prover algorithm P are sent to the 25 verifier algorithm V. [0312] Operation #6 includes a process (1) of reproducing coi, c 1 , ... , coN, ClN, bl bN using ChAl, ..., ChAN, ChB1, ..., ChBN, Rspi, ..., RspN, a process (2) of verifying CmtA = H(coi, cn, ... , coN, ClN) using the reproduced coi, c 1 , ..., coN, ClN, and a 30 process (3) of verifying CmtB = H(bi ..., bN) using the reproduced bi ..., bN [0313] SP336112WO00 83/121 The algorithm of the public-key authentication scheme expressed with the foregoing operation #1 to operation #6 is modified into a signature generation algorithm Sig and a signature verifying algorithm Ver illustrated in FIG. 21. [0314] 5 (Signature Generation Algorithm Sig) First, the structure of the signature generation algorithm Sig will be described. The signature generation algorithm Sig includes the following processes (1) to (8). [0315] 10 Process (1): The signature generation algorithm Sig generates ai = (roi, toi, eoi, rii, tii, eii, coi, Cii). Process (2): The signature generation algorithm Sig calculates CmtA < H(coi, cn, ... , coN, ClN) Process (3): The signature generation algorithm Sig calculates (ChAl, 15 ChAN) <- H(M, CmtA). Here, M is a document to which a signature is attached. Process (4): The signature generation algorithm Sig generates bi = (tii, e 1 ) for i= 1 to N. Process (5): The signature generation algorithm Sig calculates CmtB < H(bi ..., bN) 20 Process (6): The signature generation algorithm Sig calculates (ChB1, ChBN) <- H(M, Cmt, ChAl, ... , ChAN, CmtB). Additionally, modification into (ChB1, ... , ChBN) <- H(ChAl, ... , ChAN, CmtB).may be performed. Process (7): The signature generation algorithm Sig calculates Rspi <- Select (ChBi, ai, bi). 25 Process (8): The signature generation algorithm Sig sets (CmtA, CmtB, Rspi, ..., RspN) as a digital signature. [0316] (Signature Verifying Algorithm Ver) Next, the structure of the signature verifying algorithm Ver will be described. 30 The signature verifying algorithm Ver includes the following processes (1) to (5). [0317] SP336112WO00 84/121 Process (1): The signature verifying algorithm Ver calculates (ChAl, ChA) H(M, CmtA). Process (2): The signature verifying algorithm Ver calculates (ChB1, ChBN) H(M, CmtA, ChAl, ..., ChA, bi, ..., bN, CmtB). When modification into 5 (ChB1, ..., ChBN) = H(ChAl, ..., ChA, CmtB) is performed in the process (6) performed by the signature verifying algorithm Ver, the signature verifying algorithm Ver calculates (ChB1, ..., ChBN) = H(ChAl, ..., ChA, CmtB) Process (3): The signature verifying algorithm Ver generates coi, cn, ... , cON, ClN, bl, ... , bN using ChAl, ... , ChA, ChB1, ... , ChBN, Rspi, ..., RspN 10 Process (4): The signature verifying algorithm Ver verifies CmtA = H(coi, e, ... , cN, ClN) using the reproduced coi, cn, ... , cON, ClN Process (5): The signature verifying algorithm Ver verifies CmtB = H(bi, bN) using the reproduced bi, ..., bN [0318] 15 As described above, by matching the prover in the model of the public-key authentication scheme with the signer in the digital signature scheme, the algorithm of the public-key authentication scheme can be modified into the algorithm of the digital signature scheme. [0319] 20 <5: Hybrid Type Algorithm> The necessity to perform the interactive protocol a plurality of times so that the probability of a successful forgery becomes negligibly small has already been described. Further, the serial method and the parallel method have been introduced as the method of performing the interactive protocol a plurality of times. In 25 particular, the parallel method has been described giving an example of the specific parallelized algorithm. Here, a hybrid type algorithm in which a serial method and a parallel method are combined will be introduced. [0320] [5-1: Hybrid Type Algorithm Related to of 3-pass Public-key Authentication 30 Scheme] First, a hybrid type algorithm related to the 3-pass public-key authentication SP336112WO00 85/121 scheme will be described. [0321] (5-1-1: Parallel Serial Algorithm (FIG. 22)) One example of a hybrid type structure (hereinafter, referred to as a parallel 5 serial structure) will be described with reference to FIG. 22. FIG. 22 is a diagram illustrating an algorithm having a basic structure and an algorithm having a parallel serial structure. [0322] In the case of the basic structure, a message Cmt is sent from a prover to a 10 verifier at the first pass. At the second pass, a challenge Ch is sent from the verifier to the prover. At the third pass, a response Rsp is sent from the prover to the verifier. [0323] On the other hand, in the case of the parallel serial structure, messages 15 (Cmti, ..., CmtN) of N times are sent from the prover to the verifier at the first pass. At the second pass, a challenge Chi of one time is sent from the verifier to the prover. At the third pass, a response Rspi of one time is sent from the prover to the verifier. Thereafter, challenges Ch 2 , ..., ChN and responses Rsp 2 , ..., RspN are exchanged sequentially between the prover and the verifier. 20 [0324] In the case of the parallel serial structure based on the algorithm of the public-key authentication scheme described above, the security against a passive attach is ensured. Further, the number of interactivities is merely 2N + 1 times. Further, when messages of N times sent at the first pass are collected with one hash 25 value, the communication efficiency can be improved. [0325] (5-1-2: Serial Parallel Algorithm (FIG. 23)) Another example of the hybrid type structure (hereinafter, referred to as a serial parallel structure) will be described with reference to FIG. 23. FIG. 23 is a 30 diagram illustrating an algorithm having a basic structure and an algorithm having a serial parallel structure.

SP336112WO00 86/121 [0326] In the case of the basic structure, a message Cmt is sent from a prover to a verifier at the first pass. At the second pass, a challenge Ch is sent from the verifier to the prover. At the third pass, a response Rsp is sent from the prover to the 5 verifier. [0327] In the case of the serial parallel structure, a message Cmti of one time is sent from the prover to the verifier at the first pass. At the second pass, a challenge Chi of one time is sent from the verifier to the prover. Thereafter, messages 10 Cmt 2 , ..., CmtN and challenges Ch 2 , ..., ChN are exchanged sequentially between the prover and the verifier. After the challenge ChN is sent from the verifier to the prover, responses Rsp2, ..., RspN of the N times are sent from the prover to the verifier. [0328] 15 In the case of the serial parallel structure based on the algorithm of the public-key authentication scheme described above, the security against an active attach is ensured. Further, the number of interactivities is merely 2N + 1 times. [0329] [5-2: Hybrid Type Algorithm Related to of 5-pass Public-key Authentication 20 Scheme] Next, a hybrid type algorithm related to the 5-pass public-key authentication scheme will be described. [0330] (5-2-1: Parallel Serial Algorithm (Structure Example #1) (FIG. 24)) 25 First, one example of a hybrid type structure (hereinafter, referred to as parallel serial structure #1) will be described with reference to FIG. 24. FIG. 24 is a diagram illustrating an algorithm having a basic structure and an algorithm having parallel serial structure #1. [0331] 30 In the case of the basic structure, a message CmtA is sent from a prover to a verifier at the first pass. At the second pass, a number ChA is sent from the verifier SP336112WO00 87/121 to the prover. At the third pass, a vector CmtB is sent from the prover to the verifier. At the fourth pass, a challenge ChB is sent from the verifier to the prover. At the fifth pass, a response Rsp is sent from the prover to the verifier. [0332] 5 In the case of parallel serial structure #1, messages (CmtA1, ... , CmtA) of the N times are sent from the prover to the verifier at the first pass. At the second pass, a number ChAl of one time is sent from the verifier to the prover. At the third pass, a vector CmtBi of one time is sent from the prover to the verifier. At the fourth pass, a challenge ChBi of one time is sent from the verifier to the prover. At 10 the fifth pass, a response Rspi of one time is sent from the prover to the verifier. Thereafter, ChA2, ..., ChA, CmtB2, ... , CmtBN, ChB2, ..., ChBN, and responses Rsp 2 , RspN are exchanged sequentially between the prover and the verifier. [0333] In the case of parallel serial structure #1, the security against a passive 15 attach is ensured. Further, the number of interactivities is merely 4N + 1 times. Further, when the messages of N times sent at the first pass are collected with one hash value, the communication efficiency can be improved. [0334] (5-2-2: Parallel Serial Algorithm (Structure Example #2) (FIG. 25)) 20 Next, another example of the hybrid type structure (hereinafter, referred to as parallel serial structure #2) will be described with reference to FIG. 25. FIG. 25 is a diagram illustrating an algorithm having a basic structure and an algorithm having parallel serial structure #2. [0335] 25 In the case of parallel serial structure #2, messages (CmtA1, ... , CmtA) Of the N times are sent from the prover to the verifier at the first pass. At the second pass, numbers (ChAl, ..., ChA) of the N times are sent from the verifier to the prover. At the third pass, vectors (CmtB1, ... , CmtBN) of the N times are sent from the prover to the verifier. At the fourth pass, a challenge ChBi of one time is sent from the 30 verifier to the prover. At the fifth pass, a response Rspi of one time is sent from the prover to the verifier. Thereafter, ChB2, ..., ChBN, responses Rsp 2 , ..., RspN are SP336112WO00 88/121 exchanged sequentially between the prover and the verifier. [0336] In the case of parallel serial structure #2, the security against a passive attach is ensured. Further, the number of interactivities is merely 2N + 3 times. 5 Further, when the messages of N times sent at the first pass, the vectors of the N times sent at the third pass, and the like are collected with one hash value, the communication efficiency can be improved. [0337] (5-2-3: Serial Parallel Algorithm (Structure Example #1) (FIG. 26)) 10 Next, another example of the hybrid type structure (hereinafter, referred to as serial parallel structure #1) will be described with reference to FIG. 26. FIG. 26 is a diagram illustrating an algorithm having a basic structure and an algorithm having serial parallel structure #1. [0338] 15 In the case of serial parallel structure #1, a message CmtA1 of one time is sent from the prover to the verifier at the first pass. At the second pass, a number ChAl of one time is sent from the verifier to the prover. At the third pass, a vector CmtB1 of one time is sent from the prover to the verifier. At the fourth pass, a challenge ChB1 of one time is sent from the verifier to the prover. Thereafter, 20 CmtA2, ... , CmtAN, ChA2, ..., ChAN, CmtB2, ..., CmtBN, ChB2, ..., ChBN are exchanged sequentially between the prover and the verifier. Finally, responses (Rspi, ..., RspN) of the N times are sent from the prover to the verifier. [0339] In the case of serial parallel structure #1, the security against an active 25 attach is ensured. Further, the number of interactivities is merely 4N + 1 times. [0340] (5-2-4: Serial Parallel Algorithm (Structure Example #2) (FIG. 27)) Next, another example of the hybrid type structure (hereinafter, referred to as serial parallel structure #2) will be described with reference to FIG. 27. FIG. 27 30 is a diagram illustrating an algorithm having a basic structure and an algorithm having serial parallel structure #2.

SP336112WO00 89/121 [0341] In the case of serial parallel structure #2, a message CmtA1 of one time is sent from the prover to the verifier at the first pass. At the second pass, a number ChAl of one time is sent from the verifier to the prover. Thereafter, CmtA2, ---, 5 CmtAN, ChA2, ..., ChAN are exchanged sequentially between the prover and the verifier. After the exchange of ChAN is completed, vectors (CmtBl, ... , CmtBN) Of the N times are sent from the prover to the verifier. Subsequently, challenges (ChB1, ..., ChB1) of the N times are sent from the verifier to the prover. Finally, responses (Rspi, ..., RspN) of the N times are sent from the prover to the verifier. 10 [0342] In the case of serial parallel structure #2, the security against an active attach is ensured. Further, the number of interactivities is merely 2N + 3 times. [0343] The hybrid type algorithms related to the 5-pass public-key authentication 15 scheme have been described above. [0344] <6: Supplement> Here, the description of the foregoing public-key authentication scheme will be supplemented. 20 [0345] [6-1: Method of Setting System Parameter] Here, the description of a method of setting a parameter will be supplemented. [0346] 25 (Coefficients of Multivariate Polynomials) How to set coefficients of the multivariate polynomials and a random number seed (hereinafter, referred to as coefficients and the like of the multivariate polynomials) used to generate the coefficients have not been described above. The coefficients and the like of the multivariate polynomials may be parameters common 30 to a system or may be parameters different for each user. [0347] SP336112WO00 90/121 However, when the coefficients and the like of the multivariate polynomials are set to parameters common to a system, it may be necessary to update the setting of the entire system if weakness for the multivariate polynomials is found. Additionally, average robustness (difficulty of solving) is analyzed for the 5 multivariate polynomials having randomly selected coefficients, but it is difficult to ensure sufficient robustness for the multivariate polynomials having certain specific coefficients. [0348] Accordingly, the inventors of the present technology have devised a 10 structure in which coefficients of multivariate polynomials are generated by using a character string or the like selected by each user in a seed of a pseudo-random number generator and generating the coefficients of the multivariate polynomials. For example, conceivable methods include a method of using an e-mail address of a user in a seed and a method of using a character string in which an e-mail address, an 15 update date, and the like are combined in a seed. When such methods are used, an influence is limited only to a user using the multivariate polynomials having the coefficients even if weakness is found in the multivariate polynomials having the coefficients generated from a given character string. Additionally, since the multivariate polynomials are changed merely by changing a character string, the 20 weakness can easily be resolved. [0349] The method of setting system parameters has been described above. In the foregoing description, a character string has been given as an example, but a different number string or a different sign string may be used for each user. 25 [0350] (Number m of Polynomial and Number n of Variable) The interactive protocol described above ensures the security against a passive attack. However, when the interactive protocol is performed repeatedly in parallel, a condition to be described below is necessary in order to prove that the 30 security against an active attack is reliably ensured. [0351] SP336112WO00 91/121 The foregoing interactive protocol is an algorithm for verifying to a verifier that "a prover knows s satisfying y = F(s) for y" by using a pair of keys (a public key y and a secret key s). For this reason, when interactivity accepted in verification is performed, a probability of information, which indicates that "the prover uses s at the 5 time of interactivity," known to the verifier is undeniable. Additionally, collision resistance is not ensured for the multivariate polynomial F. For this reason, when the foregoing interactive protocol is performed repeatedly in parallel, it is difficult to prove that the security against an active attack is reliably ensured without any condition. 10 [0352] Accordingly, the inventors of the present technology have examined a method of causing information indicating that "a prover uses s at the time of interactivity" not to be known to a verifier even when interactivity accepted in verification is performed. Additionally, the inventors of the present technology 15 have devised a method of enabling the security against an active attack to be ensured even when the foregoing interactive protocol is performed repeatedly in parallel. This method is a method of setting the number m of multivariate polynomials f 1 , ..., fm used as public keys to a value sufficiently smaller than the number n of variables. For example, m and n are set such that 2 -" << 1 (for example, when n = 160 and m 20 = 80, 2-0 1). [0353] In the schemes that base their safety on the difficulty of solving multi-order multivariate simultaneous equations, it is difficult to generate another secret key S2 corresponding to a public key pk even when a secret key si and the public key pk 25 corresponding thereto are given. For this reason, when it is ensured that two or more secret keys s exist for the public key pk, the information indicating that "a prover uses s at the time of interactivity" can be caused not to be known to a verifier even when interactivity accepted in verification is performed. That is, when this ensuring is established, the security against an active attack can be ensured even 30 when the interactive protocol is performed repeatedly in parallel. [0354] SP336112WO00 92/121 When a function F: K" -> K' including the number m of multi-order polynomials with n variables (where n > m) is considered with reference to FIG. 29, the number of elements of the domain of definition having no second pre-image is IKI' - 1 at the most. For this reason, when IKI'-" is set to be sufficiently small, a 5 selection probability of elements of the domain of definition having no second pre image can be made negligibly small. That is, when the number m of multi-order polynomials fi, ..., fm with n variables is set to a value sufficiently smaller than the number n of variables, it can be ensured that two or more secret keys s exist for the public key pk. Consequently, even when interactivity accepted in verification is 10 performed, the information indicating that "a prover uses s at the time of interactivity" can be caused not to be known to a verifier. Thus, the security against an active attack is ensured even when the interactive protocol is performed repeatedly in parallel. [0355] 15 As described above, by imposing the setting condition in which the number m of multi-order polynomials fi, ..., fm with n variables is set to a value sufficiently smaller than the number n of variables (where n > m and preferably 2"-" << 1), the security can be ensured when the interactive protocol is performed repeatedly in parallel. 20 [0356] [6-2: Method of Responding to Irregular Challenge] Here, a method of responding to an irregular challenge will be examined. [0357] (6-2-1: Responding Method By Prover) 25 A probability of a verifier giving a false challenge in the interactive protocol will be considered. For example, in the case of the 3-pass scheme, a prover sends messages (co, c 1 , c2) to the verifier and the verifier sends a challenge Ch = 0 to the prover. Thereafter, a response Rsp corresponding to the challenge Ch = 0 is sent from the prover to the verifier. So far, normal interactivity has been performed. 30 [0358] Thereafter, it will be assumed that the verifier further challenges a response SP336112WO00 93/121 Rsp corresponding to a challenge Ch = 1 to the prover. If the prover sends the response Rsp responding to the challenge Ch = 1 to the verifier in response to the challenge, a secret key may be leaked to the verifier. The leakage of the secret key can occur in practice. For example, the verifier may feign to send the challenge Ch 5 = 0 rather than the challenge Ch = 1 at the second pass and may further challenge the response Rsp responding to the challenge Ch = 1. On the other hand, the prover may misunderstand that bits of the challenge Ch sent at the second pass turn into different bits due to a communication error. [0359] 10 Accordingly, the inventors of the present technology have devised, as a method of avoiding leakage of a secret key, a method of terminating interactivity or resuming the interactivity from the first pass using a new random number when a prover challenges a response corresponding to challenges Ch of two or more methods with respect to a message of one time. When this method is applied, a 15 secret key is not leaked even when a verifier feigns and challenges a response corresponding to challenges Ch of two or more methods. [0360] (6-2-2: Responding Method by Verifier) Next, a probability of a prover feigning and challenging resending of a 20 challenge Ch will be considered. For example, assumes that a prover sends messages (co, c 1 , c2) to a verifier in the 3-pass scheme, the verifier sends the challenge Ch = 0 to the prover, and then the prover challenges resending of the challenge Ch. When the verifier randomly reselects the challenge Ch in response to the challenge, there is a probability of the challenge Ch = 1, which is different from 25 the previously sent challenge Ch = 0, being selected. In this case, the challenge Ch = 1 is sent from the verifier to the prover. It is assumed that the prover can send the response Rsp corresponding to the challenge Ch = 1 to the verifier. [0361] In this case, the prover can respond to the challenge Ch = 1, but may not 30 respond to the challenge Ch = 0. That is, a probability of the prover deceiving the verifier is undeniable. For example, the prover may challenge resending of the SP336112WO00 94/121 challenge Ch to the verifier since the prover loses the challenge Ch. On the other hand, the verifier may consider the previously sent challenge to be lost due to a communication error and resend the challenge Ch in response to the challenge of the prover. Then, when the resent challenge Ch is different from the previous sent 5 challenge Ch, the forgery may succeed. [0362] As understood from this example, the prover may face a risk of forgery since the challenge Ch is randomly selected. Accordingly, in order not to present a risk of forgery, the inventors of the present technology have devised a method of 10 improving the interactive protocol by causing the verifier to terminate interactivity or resending the challenge Ch which is the same as the previous challenge rather than generating a new random number when the prover re-challenges sending of the challenge Ch with respect to a message of one time. Applying this method enables elimination of a risk of forgery using a challenge to resend a challenge Ch. 15 [0363] The safe method of responding to an irregular challenge has been described above. In the foregoing description, the basic structure of the 3-pass has been exemplified. However, the security can be improved by also applying the same idea to the serial repetition structure, a parallel repetition structure, or a hybrid type 20 repetition structure. Of course, the same can also apply to the algorithms related to the 5-pass. [0364] <7: Example of Hardware Configuration> Each algorithm described above can be performed by using, for example, 25 the hardware configuration of the information processing apparatus shown in FIG. 28. That is, processing of each algorithm can be realized by controlling the hardware shown in FIG. 28 using a computer program. Additionally, the mode of this hardware is arbitrary, and may be a personal computer, a mobile information terminal such as a mobile phone, a PHS or a PDA, a game machine, a contact or non-contact 30 IC chip, a contact or non-contact IC card, or various types of information appliances. Moreover, the PHS is an abbreviation for Personal Handy-phone System. Also, the SP336112WO00 95/121 PDA is an abbreviation for Personal Digital Assistant. [0365] As shown in FIG. 28, this hardware mainly includes a CPU 902, a ROM 904, a RAM 906, a host bus 908, and a bridge 910. Furthermore, this hardware includes 5 an external bus 912, an interface 914, an input unit 916, an output unit 918, a storage unit 920, a drive 922, a connection port 924, and a communication unit 926. Moreover, the CPU is an abbreviation for Central Processing Unit. Also, the ROM is an abbreviation for Read Only Memory. Furthermore, the RAM is an abbreviation for Random Access Memory. 10 [0366] The CPU 902 functions as an arithmetic processing unit or a control unit, for example, and controls entire operation or a part of the operation of each structural element based on various programs recorded on the ROM 904, the RAM 906, the storage unit 920, or a removable recording medium 928. The ROM 904 is means 15 for storing, for example, a program to be loaded on the CPU 902 or data or the like used in an arithmetic operation. The RAM 906 temporarily or perpetually stores, for example, a program to be loaded on the CPU 902 or various parameters or the like arbitrarily changed in execution of the program. [0367] 20 These structural elements are connected to each other by, for example, the host bus 908 capable of performing high-speed data transmission. For its part, the host bus 908 is connected through the bridge 910 to the external bus 912 whose data transmission speed is relatively low, for example. Furthermore, the input unit 916 is, for example, a mouse, a keyboard, a touch panel, a button, a switch, or a lever. 25 Also, the input unit 916 may be a remote control that can transmit a control signal by using an infrared ray or other radio waves. [0368] The output unit 918 is, for example, a display device such as a CRT, an LCD, a PDP or an ELD, an audio output device such as a speaker or headphones, a printer, 30 a mobile phone, or a facsimile, that can visually or auditorily notify a user of acquired information. Moreover, the CRT is an abbreviation for Cathode Ray Tube.

SP336112WO00 96/121 The LCD is an abbreviation for Liquid Crystal Display. The PDP is an abbreviation for Plasma Display Panel. Also, the ELD is an abbreviation for Electro Luminescence Display. [0369] 5 The storage unit 920 is a device for storing various data. The storage unit 920 is, for example, a magnetic storage device such as a hard disk drive (HDD), a semiconductor storage device, an optical storage device, or a magneto-optical storage device. The HDD is an abbreviation for Hard Disk Drive. [0370] 10 The drive 922 is a device that reads information recorded on the removable recording medium 928 such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, or writes information in the removable recording medium 928. The removable recording medium 928 is, for example, a DVD medium, a Blu-ray medium, an HD-DVD medium, various types of semiconductor 15 storage media, or the like. Of course, the removable recording medium 928 may be, for example, an electronic device or an IC card on which a non-contact IC chip is mounted. The IC is an abbreviation for Integrated Circuit. [0371] The connection port 924 is a port such as an USB port, an IEEE1394 port, a 20 SCSI, an RS-232C port, or a port for connecting an externally connected device 930 such as an optical audio terminal. The externally connected device 930 is, for example, a printer, a mobile music player, a digital camera, a digital video camera, or an IC recorder. Moreover, the USB is an abbreviation for Universal Serial Bus. Also, the SCSI is an abbreviation for Small Computer System Interface. 25 [0372] The communication unit 926 is a communication device to be connected to a network 932, and is, for example, a communication card for a wired or wireless LAN, Bluetooth (registered trademark), or WUSB, an optical communication router, an ADSL router, or a device for contact or non-contact communication. The 30 network 932 connected to the communication unit 926 is configured from a wire connected or wirelessly connected network, and is the Internet, a home-use LAN, SP336112WO00 97/121 infrared communication, visible light communication, broadcasting, or satellite communication, for example. Moreover, the LAN is an abbreviation for Local Area Network. Also, the WUSB is an abbreviation for Wireless USB. Furthermore, the ADSL is an abbreviation for Asymmetric Digital Subscriber Line. 5 [0373] <8: Summary> Lastly, the technical contents according to the embodiment of the present technology will be briefly described. The technical contents stated here can be applied to various information processing apparatuses, such as a personal computer, 10 a mobile phone, a game machine, an information terminal, an information appliance, a car navigation system, and the like. Further, the function of the information processing apparatus described below can be realized by using a single information processing apparatus or using a plurality of information processing apparatuses. Furthermore, a data storage means and an arithmetic processing means which are 15 used for performing a process by the information processing apparatus described below may be mounted on the information processing apparatus, or may be mounted on a device connected via a network. [0374] The functional configuration of the foregoing information processing 20 apparatus is realized as follows. For example, an information processing apparatus described in the following (1) has a function of executing an algorithm related to an efficient public-key authentication scheme that bases its safety on the difficulty of solving multi-order multivariate simultaneous equations. [0375] 25 (1) An information processing apparatus including: a message generation unit that generates a message based on a pair of multi order multivariate polynomials F = (fi, ..., fin) and a vector s that is an element of a set K"; 30 a message supply unit that supplies the message to a verifier storing the pair of multi-order multivariate polynomials F and vectors y = (yi, ..., ym) = (fi(s), ..., SP336112WO00 98/121 fm(s)); an intermediate information generation unit that generates third information based on first information randomly selected by the verifier and second information obtained at a time of generation of the message; 5 an intermediate information supply unit that supplies the third information to the verifier; and a response supply unit that supplies the verifier with response information corresponding to a verification pattern which the verifier selects from among k (where k > 2) verification patterns, 10 wherein the vector s is a secret key, wherein the pair of multi-order multivariate polynomials F and the vectors y are public keys, wherein the message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response 15 information based on the public keys, the first information, the third information, and the response information, and wherein the pair of multi-order multivariate polynomials F include polynomials fi, ..., fm defined in a ring R of a characteristic q and an order qk and are set in a manner that a polynomial G(x 1 , x 2 ) defined as G(x 1 , x 2 ) = F(x 1 + x 2 ) - F(x 1 ) 20 F(x 2 ) with respect to vectors xi (xiu, ..., xi 1 1 ) (where 1= 1, 2) is configured as a term proportional to (xl 1 )q(,) (where 1 i n, q(z) = qz, and 1 < z k). [0376] (2) The information processing apparatus according to (1), 25 wherein the message generation unit generates the messages of N times (where N > 2), wherein the message supply unit supplies the verifier with the messages of the N times with interactivity of one time; wherein the intermediate information generation unit generates the third 30 information of the N times based on the first information selected by the verifier for the messages of the N times and the second information of the N times obtained at SP336112WO00 99/121 the time of the generation of the messages, wherein the intermediate information supply unit supplies the verifier with the third information of the N times with interactivity of one time, and wherein the response supply unit supplies the verifier with the response 5 information of the N times corresponding to the verification pattern selected by the verifier for the messages of the N times, with interactivity of one time. [0377] (3) The information processing apparatus according to (2), 10 wherein the message generation unit generates the messages of the N times (where N > 2) and generates one hash value from the messages of the N times, wherein the message supply unit supplies the hash value to the verifier, wherein the intermediate information generation unit generates the third information of the N times based on the first information selected by the verifier for 15 each of the messages of the N times and the second information of the N times obtained at the time of the generation of the messages, wherein the intermediate information supply unit supplies the verifier with the third information of the N times with interactivity of one time, and wherein the response supply unit supplies the verifier with the response 20 information of the N times corresponding to the verification pattern selected by the verifier for each of the messages of the N times and some of messages not obtained even in execution of the calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys and the response information, with interactivity of one time. 25 [0378] (4) An information processing apparatus including: an information storage unit that stores a pair of multi-order multivariate polynomials F = (fi, ..., fn) and vectors y = (yi, ..., ym) = (fi(s), ..., fm(s)); 30 a message acquisition unit that acquires a message generated based on the pair of multi-order multivariate polynomials F and a vector s which is an element of SP336112WO00 100/121 a set K"; an information supply unit that supplies randomly selected first information to a prover that supplies the message; an intermediate information acquisition unit that acquires third information 5 generated by the prover based on the first information and second information obtained at a time of generation of the message; a pattern information supply unit that supplies the prover with information on one verification pattern randomly selected from among k (where k > 3) verification patterns; 10 a response acquisition unit that acquires response information corresponding to the selected verification pattern from the prover; and a verification unit that verifies whether or not the prover stores the vector s based on the message, the first information, the third information, the pair of multi order multivariate polynomials F, and the response information, 15 wherein the vector s is a secret key, wherein the pair of multi-order multivariate polynomials F and the vectors y are public keys, wherein the message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response 20 information based on the public keys, the first information, the third information, and the response information, and wherein the pair of multi-order multivariate polynomials F include polynomials fi, ..., fm defined in a ring R of a characteristic q and an order qk and are set in a manner that a polynomial G(xi, x2) defined as G(x1, x2) = F(xi + x2) - F(xi) 25 F(x 2 ) with respect to vectors xi (x 1 , ..., xi 1 ) (where 1= 1, 2) is configured as a term proportional to (xl 1 )q(z) (where 1 i n, q(z) = qz, and 1 < z k). [0379] (5) The information processing apparatus according to (4), 30 wherein the message acquisition unit acquires the messages of N (where N 2) times with interactivity of one time, SP336112WO00 101/121 wherein the information supply unit randomly selects the first information for each of the messages of the N times and supplies the prover with the selected first information of the N times with interactivity of one time, wherein the intermediate information acquisition unit acquires the third 5 information of the N times generated by the prover based on the first information of the N times and the second information of the N times obtained at the time of the generation of the messages of the N times, wherein the pattern information supply unit selects the verification pattern for each of the messages of the N times and supplies the prover with information on 10 the selected verification patterns of the N times with interactivity of one time, wherein the response acquisition unit acquires the response information of the N times corresponding to the selected verification patterns of the N times from the prover with interactivity of one time, and wherein the verification unit determines that the prover stores the vector s, 15 when verification succeeds for all of the messages of the N times. [0380] (6) The information processing apparatus according to (5), wherein the message acquisition unit acquires one hash value generated 20 from the messages of the N times (where N > 2), wherein the information supply unit randomly selects the first information for each of the messages of the N times and supplies with the prover with the selected first information of the N times with interactivity of one time, wherein the intermediate information acquisition unit acquires the third 25 information of the N times generated by the prover based on the first information of the N times and the second information of the N times obtained at the time of the generation of the messages of the N times, wherein the pattern information supply unit selects the verification pattern for each of the messages of the N times and supplies the prover with the information 30 on the selected verification patterns of the N times with interactivity of one time, wherein the response acquisition unit acquires, from the prover, the response SP336112WO00 102/121 information corresponding to the selected verification pattern and some of the messages not obtained even in execution of the calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and the response information, 5 and wherein the verification unit verifies whether or not the prover stores the vector s based on the hash value, some of the messages, the public keys, and the response information and determines that the prover stores the vector s, when the verification succeeds for all of the messages of the N times. 10 [0381] (7) An information processing method including: generating a message based on a pair of multi-order multivariate polynomials F = (fi, ..., fn) and a vector s that is an element of a set K"; 15 supplying the message to a verifier storing the pair of multi-order multivariate polynomials F and vectors y = (yi, ..., ym) = (fi(s), ..., fm(s)); generating third information based on first information randomly selected by the verifier and second information obtained at a time of generation of the message; 20 supplying the third information to the verifier; and supplying the verifier with response information corresponding to a verification pattern which the verifier selects from among k (where k > 2) verification patterns, wherein the vector s is a secret key, 25 wherein the pair of multi-order multivariate polynomials F and the vectors y are public keys, wherein the message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and 30 the response information, and wherein the pair of multi-order multivariate polynomials F include SP336112WO00 103/121 polynomials fi, ..., fm defined in a ring R of a characteristic q and an order q and are set in a manner that a polynomial G(xi, x2) defined as G(x1, x2) = F(xi + x2) - F(xi) F(x 2 ) with respect to vectors xi (xli, ..., xin) (where 1= 1, 2) is configured as a term proportional to (xl 1 )q(z) (where 1 i n, q(z) = qz, and 1 < z k). 5 [0382] (8) An information processing method including: by an information processing apparatus storing a pair of multi-order multivariate polynomials F = (fi, ..., fn) and vectors y = (yi, ..., ym) = (fi(s), ..., fm(s)), 10 acquiring a message generated based on the pair of multi-order multivariate polynomials F and a vector s which is an element of a set K"; supplying randomly selected first information to a prover that supplies the message; acquiring third information generated by the prover based on the first 15 information and second information obtained at a time of generation of the message; supplying the prover with information on one verification pattern randomly selected from among k (where k > 3) verification patterns; and acquiring response information corresponding to the selected verification pattern from the prover; 20 verifying whether or not the prover stores the vector s based on the message, the first information, the third information, the pair of multi-order multivariate polynomials F, and the response information, wherein the vector s is a secret key, wherein the pair of multi-order multivariate polynomials F and the vectors y 25 are public keys, wherein the message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and the response information, and 30 wherein the pair of multi-order multivariate polynomials F include polynomials fi, ..., fm defined in a ring R of a characteristic q and an order q and are SP336112WO00 104/121 set in a manner that a polynomial G(x1, x 2 ) defined as G(xi, x 2 ) = F(x1 + x 2 ) - F(xi) F(x 2 ) with respect to vectors xi (xli, ..., xi.) (where 1= 1, 2) is configured as a term proportional to (xl 1 )q(z) (where 1 i n, q(z) = qz, and 1 < z k). [0383] 5 (9) A program causing a computer to realize: a message generation function of generating a message based on a pair of multi-order multivariate polynomials F = (fi, ..., fn) and a vector s that is an element of a set K"; 10 a message supply function of supplying the message to a verifier storing the pair of multi-order multivariate polynomials F and vectors y = (yi, ..., ym) = (fi(s), fm(s)); an intermediate information generation function of generating third information based on first information randomly selected by the verifier and second 15 information obtained at a time of generation of the message; an intermediate information supply function of supplying the third information to the verifier; and a response supply function of supplying the verifier with response information corresponding to a verification pattern which the verifier selects from 20 among k (where k > 2) verification patterns, wherein the vector s is a secret key, wherein the pair of multi-order multivariate polynomials F and the vectors y are public keys, wherein the message is information obtained by executing calculation 25 prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and the response information, and wherein the pair of multi-order multivariate polynomials F include polynomials fi, ..., fm defined in a ring R of a characteristic q and an order qk and are 30 set in a manner that a polynomial G(x 1 , x2) defined as G(x 1 , x2) = F(x 1 + x2) - F(x 1 ) F(x 2 ) with respect to vectors xi = (xli, ..., xln) (where 1 = 1, 2) is configured as a term SP336112WO00 105/121 proportional to (xl 1 )q(z) (where 1 i n, q(z) = qz, and 1 < z k). [0384] (10) A program causing a computer to realize: 5 an information storage function of storing a pair of multi-order multivariate polynomials F = (fi, ..., fn) and vectors y = (yi, ..., ym) = (fi(s), ..., fm(s)); a message acquisition function of acquiring a message generated based on the pair of multi-order multivariate polynomials F and a vector s which is an element of a set K"; 10 an information supply function of supplying randomly selected first information to a prover that supplies the message; an intermediate information acquisition function of acquiring third information generated by the prover based on the first information and second information obtained at a time of generation of the message; 15 a pattern information supply function of supplying the prover with information on one verification pattern randomly selected from among k (where k > 3) verification patterns; and a response acquisition unit of acquiring response information corresponding to the selected verification pattern from the prover; 20 a verification function that verifies whether or not the prover stores the vector s based on the message, the first information, the third information, the pair of multi-order multivariate polynomials F, and the response information, wherein the vector s is a secret key, wherein the pair of multi-order multivariate polynomials F and the vectors y 25 are public keys, wherein the message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and the response information, and 30 wherein the pair of multi-order multivariate polynomials F include polynomials fi, ..., fm defined in a ring R of a characteristic q and an order q and are SP336112WO00 106/121 set in a manner that a polynomial G(x1, x 2 ) defined as G(xi, x 2 ) = F(x1 + x 2 ) - F(xi) F(x 2 ) with respect to vectors xi (xli, ..., xi.) (where 1= 1, 2) is configured as a term proportional to (xl 1 )q(z) (where 1 i n, q(z) = qz, and 1 < z k). [0385] 5 (11) A computer-readable recording medium having a program recorded thereon, the program causing a computer to realize: a message generation function of generating a message based on a pair of multi-order multivariate polynomials F = (fi, ..., fn) and a vector s that is an element 10 of a set K" 1 ; a message supply function of supplying the message to a verifier storing the pair of multi-order multivariate polynomials F and vectors y = (yi, ..., ym) = (fi(s), fm(s)); an intermediate information generation function of generating third 15 information based on first information randomly selected by the verifier and second information obtained at a time of generation of the message; an intermediate information supply function of supplying the third information to the verifier; and a response supply function of supplying the verifier with response 20 information corresponding to a verification pattern which the verifier selects from among k (where k > 2) verification patterns, wherein the vector s is a secret key, wherein the pair of multi-order multivariate polynomials F and the vectors y are public keys, 25 wherein the message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and the response information, and wherein the pair of multi-order multivariate polynomials F include 30 polynomials fi, ..., fm defined in a ring R of a characteristic q and an order qk and are set in a manner that a polynomial G(x 1 , x2) defined as G(x 1 , x2) = F(x 1 + x2) - F(x 1 ) - SP336112WO00 107/121 F(x 2 ) with respect to vectors xi (xii, ..., xi.) (where 1= 1, 2) is configured as a term proportional to (xl 1 )q(z) (where 1 i n, q(z) = qz, and 1 < z k). [0386] (12) 5 A computer-readable recording medium having a program recorded thereon, the program causing a computer to realize: an information storage function of storing a pair of multi-order multivariate polynomials F = (fi, ..., fn) and vectors y = (yi, ..., yin) = (fi(s), ..., fm(s)); a message acquisition function of acquiring a message generated based on 10 the pair of multi-order multivariate polynomials F and a vector s that is an element of a set K"; an information supply function of supplying randomly selected first information to a prover that supplies the message; an intermediate information acquisition function of acquiring third 15 information generated by the prover based on the first information and second information obtained at a time of generation of the message; a pattern information supply function of supplying the prover with information on one verification pattern randomly selected from among k (where k > 3) verification patterns; 20 a response acquisition unit of acquiring response information corresponding to the selected verification pattern from the prover; and a verification function of verifying whether or not the prover stores the vector s based on the message, the first information, the third information, the pair of multi-order multivariate polynomials F, and the response information, 25 wherein the vector s is a secret key, wherein the pair of multi-order multivariate polynomials F and the vectors y are public keys, wherein the message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response 30 information based on the public keys, the first information, the third information, and the response information, and SP336112WO00 108/121 wherein the pair of multi-order multivariate polynomials F include polynomials fi, ..., fm defined in a ring R of a characteristic q and an order qk and are set in a manner that a polynomial G(x 1 , x2) defined as G(x 1 , x2) = F(x 1 + x2) - F(x 1 ) F(x 2 ) with respect to vectors xi (xii, ..., xi) (where 1= 1, 2) is configured as a term 5 proportional to (xl 1 )q(z) (where 1 i n, q(z) = qz, and 1 < z k). [0387] (13) The apparatus according to any one of (1) to (6), wherein m and n described above have a relation of m < n. 10 [0388] (14) The apparatus according to (13), wherein m and n described above have a relation of 2' << 1. [0389] 15 (Remark) The foregoing prover algorithm P is an example of the message generation unit, the message supply unit, the response supply unit, the intermediate information generation unit, and the intermediate information supply unit. Additionally, the foregoing verifier algorithm V is an example of the information storage unit, the 20 message acquisition unit, the pattern information supply unit, the response acquisition unit, the verification unit, and the intermediate information acquisition unit. [0390] The preferred embodiments of the present invention have been described 25 above with reference to the accompanying drawings, whilst the present invention is not limited to the above examples, of course. A person skilled in the art may find various alternations and modifications within the scope of the appended claims, and it should be understood that they will naturally come under the technical scope of the present invention. 30 Reference Signs List SP336112WO00 109/121 [0391] Gen key generation algorithm P prover algorithm V verifier algorithm 5 Sig signature generation algorithm Ver signature verifying algorithm SP336112WO00 110/121 CLAIMS Claim 1 An information processing apparatus comprising: a message generation unit that generates a message based on a pair of multi 5 order multivariate polynomials F = (fi, ..., fn) and a vector s that is an element of a set K"; a message supply unit that supplies the message to a verifier storing the pair of multi-order multivariate polynomials F and vectors y = (yi, ..., ym) = (fi(s), fm(s)); 10 an intermediate information generation unit that generates third information based on first information randomly selected by the verifier and second information obtained at a time of generation of the message; an intermediate information supply unit that supplies the third information to the verifier; and 15 a response supply unit that supplies the verifier with response information corresponding to a verification pattern which the verifier selects from among k (where k > 2) verification patterns, wherein the vector s is a secret key, wherein the pair of multi-order multivariate polynomials F and the vectors y 20 are public keys, wherein the message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and the response information, and 25 wherein the pair of multi-order multivariate polynomials F include polynomials fi, ..., fm defined in a ring R of a characteristic q and an order q and are set in a manner that a polynomial G(xi, x2) defined as G(x1, x2) = F(x1 + x2) - F(x1) F(x 2 ) with respect to vectors xi = (x 1 , ..., xi 1 ) (where 1 = 1, 2) is configured as a term proportional to (xl 1 )q(z) (where 1 i n, q(z) = qz, and 1 < z k). 30 Claim 2 SP336112WO00 111/121 The information processing apparatus according to claim 1, wherein the message generation unit generates the messages of N times (where N > 2), wherein the message supply unit supplies the verifier with the messages of 5 the N times with interactivity of one time; wherein the intermediate information generation unit generates the third information of the N times based on the first information selected by the verifier for the messages of the N times and the second information of the N times obtained at the time of the generation of the messages, 10 wherein the intermediate information supply unit supplies the verifier with the third information of the N times with interactivity of one time, and wherein the response supply unit supplies the verifier with the response information of the N times corresponding to the verification pattern selected by the verifier for the messages of the N times, with interactivity of one time. 15 Claim 3 The information processing apparatus according to claim 2, wherein the message generation unit generates the messages of the N times (where N > 2) and generates one hash value from the messages of the N times, 20 wherein the message supply unit supplies the hash value to the verifier, wherein the intermediate information generation unit generates the third information of the N times based on the first information selected by the verifier for each of the messages of the N times and the second information of the N times obtained at the time of the generation of the messages, 25 wherein the intermediate information supply unit supplies the verifier with the third information of the N times with interactivity of one time, and wherein the response supply unit supplies the verifier with the response information of the N times corresponding to the verification pattern selected by the verifier for each of the messages of the N times and some of messages not obtained 30 even in execution of the calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys and the response SP336112WO00 112/121 information, with interactivity of one time. Claim 4 An information processing apparatus comprising: 5 an information storage unit that stores a pair of multi-order multivariate polynomials F = (fi, ..., fn) and vectors y = (yi, ..., ym) = (fi(s), ..., fm(s)); a message acquisition unit that acquires a message generated based on the pair of multi-order multivariate polynomials F and a vector s which is an element of a set K"; 10 an information supply unit that supplies randomly selected first information to a prover that supplies the message; an intermediate information acquisition unit that acquires third information generated by the prover based on the first information and second information obtained at a time of generation of the message; 15 a pattern information supply unit that supplies the prover with information on one verification pattern randomly selected from among k (where k > 3) verification patterns; a response acquisition unit that acquires response information corresponding to the selected verification pattern from the prover; and 20 a verification unit that verifies whether or not the prover stores the vector s based on the message, the first information, the third information, the pair of multi order multivariate polynomials F, and the response information, wherein the vector s is a secret key, wherein the pair of multi-order multivariate polynomials F and the vectors y 25 are public keys, wherein the message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and the response information, and 30 wherein the pair of multi-order multivariate polynomials F include polynomials fi, ..., fm defined in a ring R of a characteristic q and an order q and are SP336112WO00 113/121 set in a manner that a polynomial G(x1, x 2 ) defined as G(xi, x 2 ) = F(x1 + x 2 ) - F(xi) F(x 2 ) with respect to vectors xi (xli, ..., xi.) (where 1= 1, 2) is configured as a term proportional to (xl 1 )q(z) (where 1 i n, q(z) = qz, and 1 < z k). 5 Claim 5 The information processing apparatus according to claim 4, wherein the message acquisition unit acquires the messages of N (where N > 2) times with interactivity of one time, wherein the information supply unit randomly selects the first information 10 for each of the messages of the N times and supplies the prover with the selected first information of the N times with interactivity of one time, wherein the intermediate information acquisition unit acquires the third information of the N times generated by the prover based on the first information of the N times and the second information of the N times obtained at the time of the 15 generation of the messages of the N times, wherein the pattern information supply unit selects the verification pattern for each of the messages of the N times and supplies the prover with information on the selected verification patterns of the N times with interactivity of one time, wherein the response acquisition unit acquires the response information of 20 the N times corresponding to the selected verification patterns of the N times from the prover with interactivity of one time, and wherein the verification unit determines that the prover stores the vector s, when verification succeeds for all of the messages of the N times. 25 Claim 6 The information processing apparatus according to claim 5, wherein the message acquisition unit acquires one hash value generated from the messages of the N times (where N > 2), wherein the information supply unit randomly selects the first information 30 for each of the messages of the N times and supplies with the prover with the selected first information of the N times with interactivity of one time, SP336112WO00 114/121 wherein the intermediate information acquisition unit acquires the third information of the N times generated by the prover based on the first information of the N times and the second information of the N times obtained at the time of the generation of the messages of the N times, 5 wherein the pattern information supply unit selects the verification pattern for each of the messages of the N times and supplies the prover with the information on the selected verification patterns of the N times with interactivity of one time, wherein the response acquisition unit acquires, from the prover, the response information corresponding to the selected verification pattern and some of the 10 messages not obtained even in execution of the calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and the response information, and wherein the verification unit verifies whether or not the prover stores the 15 vector s based on the hash value, some of the messages, the public keys, and the response information and determines that the prover stores the vector s, when the verification succeeds for all of the messages of the N times. Claim 7 20 An information processing method comprising: generating a message based on a pair of multi-order multivariate polynomials F = (fi, ..., fn) and a vector s that is an element of a set K"; supplying the message to a verifier storing the pair of multi-order multivariate polynomials F and vectors y = (yi, ..., ym) = (fi(s), ..., fm(s)); 25 generating third information based on first information randomly selected by the verifier and second information obtained at a time of generation of the message; supplying the third information to the verifier; and supplying the verifier with response information corresponding to a 30 verification pattern which the verifier selects from among k (where k > 2) verification patterns, SP336112WO00 115/121 wherein the vector s is a secret key, wherein the pair of multi-order multivariate polynomials F and the vectors y are public keys, wherein the message is information obtained by executing calculation 5 prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and the response information, and wherein the pair of multi-order multivariate polynomials F include polynomials fi, ..., fm defined in a ring R of a characteristic q and an order qk and are 10 set in a manner that a polynomial G(xi, x 2 ) defined as G(x1, x 2 ) = F(x1 + x 2 ) - F(x1) F(x 2 ) with respect to vectors xi (xli, ..., xin) (where 1= 1, 2) is configured as a term proportional to (xl 1 )q(z) (where 1 i n, q(z) = qz, and 1 < z k). Claim 8 15 An information processing method comprising: by an information processing apparatus storing a pair of multi-order multivariate polynomials F = (fi, fin) and vectors y = (yi, ..., ym) = (fi(s), ..., fm(s)), acquiring a message generated based on the pair of multi-order multivariate polynomials F and a vector s which is an element of a set K"; 20 supplying randomly selected first information to a prover that supplies the message; acquiring third information generated by the prover based on the first information and second information obtained at a time of generation of the message; supplying the prover with information on one verification pattern randomly 25 selected from among k (where k > 3) verification patterns; and acquiring response information corresponding to the selected verification pattern from the prover; verifying whether or not the prover stores the vector s based on the message, the first information, the third information, the pair of multi-order multivariate 30 polynomials F, and the response information, wherein the vector s is a secret key, SP336112WO00 116/121 wherein the pair of multi-order multivariate polynomials F and the vectors y are public keys, wherein the message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response 5 information based on the public keys, the first information, the third information, and the response information, and wherein the pair of multi-order multivariate polynomials F include polynomials fi, ..., fm defined in a ring R of a characteristic q and an order qk and are set in a manner that a polynomial G(xi, x2) defined as G(x1, x2) = F(xi + x2) - F(xi) 10 F(x 2 ) with respect to vectors xi (x 1 , ..., xi 1 ) (where 1= 1, 2) is configured as a term proportional to (xl 1 )q(z) (where 1 i n, q(z) = qz, and 1 < z k). Claim 9 A program causing a computer to realize: 15 a message generation function of generating a message based on a pair of multi-order multivariate polynomials F = (fi, ..., fn) and a vector s that is an element of a set K"; a message supply function of supplying the message to a verifier storing the pair of multi-order multivariate polynomials F and vectors y = (yi, ..., ym) = (fi(s), 20 fm(s)); an intermediate information generation function of generating third information based on first information randomly selected by the verifier and second information obtained at a time of generation of the message; an intermediate information supply function of supplying the third 25 information to the verifier; and a response supply function of supplying the verifier with response information corresponding to a verification pattern which the verifier selects from among k (where k > 2) verification patterns, wherein the vector s is a secret key, 30 wherein the pair of multi-order multivariate polynomials F and the vectors y are public keys, SP336112WO00 117/121 wherein the message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and the response information, and 5 wherein the pair of multi-order multivariate polynomials F include polynomials fi, ..., fm defined in a ring R of a characteristic q and an order qk and are set in a manner that a polynomial G(x1, x 2 ) defined as G(x1, x 2 ) = F(x1 + x 2 ) - F(x1) F(x 2 ) with respect to vectors xi (xli, ..., xin) (where 1= 1, 2) is configured as a term proportional to (xl 1 )q(z) (where 1 i n, q(z) = qz, and 1 < z k). 10 Claim 10 A program causing a computer to realize: an information storage function of storing a pair of multi-order multivariate polynomials F = (fi, ..., fn) and vectors y = (yi, ..., ym) = (fi(s), ..., fm(s)); 15 a message acquisition function of acquiring a message generated based on the pair of multi-order multivariate polynomials F and a vector s which is an element of a set K"; an information supply function of supplying randomly selected first information to a prover that supplies the message; 20 an intermediate information acquisition function of acquiring third information generated by the prover based on the first information and second information obtained at a time of generation of the message; a pattern information supply function of supplying the prover with information on one verification pattern randomly selected from among k (where k > 25 3) verification patterns; and a response acquisition unit of acquiring response information corresponding to the selected verification pattern from the prover; a verification function that verifies whether or not the prover stores the vector s based on the message, the first information, the third information, the pair of 30 multi-order multivariate polynomials F, and the response information, wherein the vector s is a secret key, SP336112WO00 118/121 wherein the pair of multi-order multivariate polynomials F and the vectors y are public keys, wherein the message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response 5 information based on the public keys, the first information, the third information, and the response information, and wherein the pair of multi-order multivariate polynomials F include polynomials fi, ..., fm defined in a ring R of a characteristic q and an order qk and are set in a manner that a polynomial G(xi, x2) defined as G(x1, x2) = F(xi + x2) - F(xi) 10 F(x 2 ) with respect to vectors xi (x 1 , ..., xi 1 ) (where 1= 1, 2) is configured as a term proportional to (xl 1 )q(z) (where 1 i n, q(z) = qz, and 1 < z k). Claim 11 A computer-readable recording medium having a program recorded thereon, 15 the program causing a computer to realize: a message generation function of generating a message based on a pair of multi-order multivariate polynomials F = (fi, ..., fn) and a vector s that is an element of a set K"; a message supply function of supplying the message to a verifier storing the 20 pair of multi-order multivariate polynomials F and vectors y = (yi, ..., ym) = (fi(s), fm(s)); an intermediate information generation function of generating third information based on first information randomly selected by the verifier and second information obtained at a time of generation of the message; 25 an intermediate information supply function of supplying the third information to the verifier; and a response supply function of supplying the verifier with response information corresponding to a verification pattern which the verifier selects from among k (where k > 2) verification patterns, 30 wherein the vector s is a secret key, wherein the pair of multi-order multivariate polynomials F and the vectors y SP336112WO00 119/121 are public keys, wherein the message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and 5 the response information, and wherein the pair of multi-order multivariate polynomials F include polynomials fi, ..., fm defined in a ring R of a characteristic q and an order qk and are set in a manner that a polynomial G(xi, x2) defined as G(x1, x2) = F(xi + x2) - F(xi) F(x 2 ) with respect to vectors xi (xli, ..., xin) (where 1= 1, 2) is configured as a term 10 proportional to (xl 1 )q(z) (where 1 i n, q(z) = qz, and 1 < z k). Claim 12 A computer-readable recording medium having a program recorded thereon, the program causing a computer to realize: 15 an information storage function of storing a pair of multi-order multivariate polynomials F = (fi, ..., fn) and vectors y = (yi, ..., ym) = (fi(s), ..., fm(s)); a message acquisition function of acquiring a message generated based on the pair of multi-order multivariate polynomials F and a vector s that is an element of a set K"; 20 an information supply function of supplying randomly selected first information to a prover that supplies the message; an intermediate information acquisition function of acquiring third information generated by the prover based on the first information and second information obtained at a time of generation of the message; 25 a pattern information supply function of supplying the prover with information on one verification pattern randomly selected from among k (where k > 3) verification patterns; a response acquisition unit of acquiring response information corresponding to the selected verification pattern from the prover; and 30 a verification function of verifying whether or not the prover stores the vector s based on the message, the first information, the third information, the pair of SP336112WO00 120/121 multi-order multivariate polynomials F, and the response information, wherein the vector s is a secret key, wherein the pair of multi-order multivariate polynomials F and the vectors y are public keys, 5 wherein the message is information obtained by executing calculation prepared in advance for the verification pattern corresponding to the response information based on the public keys, the first information, the third information, and the response information, and wherein the pair of multi-order multivariate polynomials F include 10 polynomials fi, ..., fm defined in a ring R of a characteristic q and an order qk and are set in a manner that a polynomial G(xi, x2) defined as G(x1, x2) = F(xi + x2) - F(xi) F(x 2 ) with respect to vectors xi = (xli, ..., xln) (where 1 = 1, 2) is configured as a term proportional to (xl 1 )q(z) (where 1 i n, q(z) = qz, and 1 < z k).